AIKNOCK: Building a Security Line for AI Execution Control at the Operating System Level

AIKNOCK is an open-source technical specification project. By introducing uncircumventable pre-execution decision points at the operating system level, it establishes mandatory control mechanisms for AI system calls, addresses the architectural flaw of current AI calls lacking an independent technical control layer, and provides an infrastructure-level solution for enterprise AI governance.

With the increasing penetration of AI in critical enterprise businesses, AI governance and risk control have become major challenges. The current AI calling model has fundamental architectural flaws: model calls occur entirely within the application layer, lacking a technical control layer independent of applications. This leads to any code that can access AI APIs being able to call models without restrictions, and post-hoc audits and logging struggle to provide sufficient visibility and binding force. This brings multiple risks: difficulty in complying with regulatory requirements (such as the EU AI Act, ISO/IEC 42001, NIS2 Directive), blurred security boundaries (AI is treated as an ordinary application function), and incomplete audit trails (application-layer logs can be tampered with or bypassed).

AIKNOCK was initiated by Italian developer Luigi Del Giudice. Its name metaphorically refers to the 'knocking' action—every AI call must first request permission. It is not an AI security scanning tool or content filter, but a technical specification that rethinks the AI execution control architecture. Core insights: Truly effective AI control must be at the operating system level (not the application layer) to ensure it cannot be bypassed or tampered with by upper-layer applications; AI capabilities are redefined as 'critical system capabilities', as important as privileged operations like file system access and network communication.

AIKNOCK builds its architecture around 'pre-execution decision points': 1. Pre-execution authorization mechanism: When an application calls an AI model, it first evaluates whether it complies with preset policies (caller authentication, time window restrictions, frequency quotas, model whitelists, etc.). Non-compliant calls are intercepted before consuming resources; 2. Uncircumventable enforceability: Control logic runs at the operating system kernel layer or equivalent privileged system services, so applications cannot bypass it through code tricks; 3. Built-in audit trail: Each authorization decision (allow/deny) generates an untamperable record containing metadata such as caller identity, request time, policy result, and model, achieving 'design as audit'; 4. Vendor and model neutrality: Defines standardized control interfaces, supports local open-source models, cloud APIs, hybrid deployments, etc., and maintains consistent governance policies.

AIKNOCK targets operational environments with high compliance requirements, providing infrastructure support for regulatory compliance: Under the EU AI Act, it provides a technical foundation for usage records of high-risk AI systems; Under the ISO/IEC 42001 standard, its mandatory audit function meets the recording and documentation requirements for AI systems; Under the ISO/IEC 27001 standard, it treats AI as a critical system capability for access control. It is suitable for regulated industries such as finance, healthcare, and critical infrastructure, helping to establish AI usage boundaries and prevent unauthorized access to sensitive data or execution of high-risk operations.

AIKNOCK is in the active development phase: Technical specifications and architectural patterns have been defined, and enterprise-level reference implementations are under development. Its open-source nature allows organizations to customize it according to their own technology stacks: For Linux systems, it can be implemented via kernel modules, system call interception, or eBPF programs; For containerized environments, it can be implemented via sidecar proxies or custom runtimes. The project clearly distinguishes between 'technical availability' and 'usage authorization'—even if an AI model is technically accessible, whether to allow the call must be decided based on policies, avoiding the gray area where 'technical feasibility implies implicit permission'.

Limitations: It focuses on execution control rather than content review, so it needs to be paired with specialized content moderation tools; Deployment requires operating system-level support or modifications, increasing the complexity of production environments; It needs to address the technical challenge of policy evaluation not significantly increasing latency. Future: AIKNOCK represents the evolution direction of AI governance from 'post-hoc audit' to 'pre-emptive control'. As AI becomes more critical in production environments, such infrastructure-level control mechanisms will become standard components of enterprise technology stacks, and its open-source specification provides a valuable reference implementation.