Putting character into AI — introducing the AI Harness in the k-ID CDK

The k-ID CDK is the compliance and safety harness behind apps and games shipping to digital youth — sessions, verifiable parental consent, age assurance, feature-level permissioning, audit trails, jurisdiction-correct defaults across 195+ markets. Tens of millions of age-aware sessions a day. Built for gaming, extended into social, hardened in market.

Today we're announcing the AI Harness — the new AI module of the k-ID CDK. You'll see it shipping across millions of AI experiences for digital youth.

This post is about the tech.

What the AI Harness is

A new vertical of the CDK, configured for AI surfaces.

It models the seven AI capabilities that matter — text chat, voice mode, media generation, media upload, memory, companion-style chat, model training — as discrete permissions, each with a country-correct default, each gateable independently, each writeable from the same /session/upgrade call that already powers gaming and social. It carries a verifiable parent linking flow that produces a real attached guardian — not an unverified email a teen filled in. It exposes a category-blind incident relay so a partner-flagged event reaches the right verified parent through a trusted channel. It surfaces daily and weekly time signals through Family Connect — the hosted parent surface at family.k-id.com, white-labelled per partner. Every consent, every permission change, every alert lands in the same audit trail the CDK produces for every other vertical it serves.

What it doesn't do: read conversation content, classify incidents, store severity metadata, or interpret what happened on the platform. The partner classifies and acts; k-ID forwards a partner-authored notice to a verified guardian. That separation is the posture: k-ID is the verified-parent registry and the harness; the partner is the product. It's what makes the compliance and safety harness defensible at scale, and it's the same posture the CDK takes everywhere it ships — k-ID is the layer underneath, never the layer in front.

Under the hood

Each of the seven AI permissions binds to a row in the CDK's Generic Compliance Engine — the same engine handling tens of millions of age-aware sessions a day across our gaming and social customers — with a per-jurisdiction default sourced from k-ID's regulatory KB. The defaults aren't hardcoded in TypeScript. They're configurable in Compliance Studio, the same surface a partner uses to set up the rest of their CDK product.

A few of the bindings worth naming.

#ai-text-chat carries the AI-chatbot rules — California's SB 243 (companion chatbots, January 1 2027), Washington's SHB 2225 (the same date), Italy's AI-specific prohibition that surfaced in the Garante's €5 million ruling against the maker of Replika.

#ai-memory is profiling. Brazil's ECA Digital, in force since March 17 2026, prohibits profiling of anyone under 18. The default lands accordingly. The April 22 2026 COPPA Rule amendments treat AI training on a child's data as a non-integral purpose — separate, affirmative parental opt-in. #ai-model-training is a new GCE row that captures it.

#ai-companion-chatbot covers personalized recommendation surfaces — DSA Article 28(2) prohibits profiling-based ads to minors in the EU; under the UK's Online Safety Act and Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024, the threshold for personalized features is higher still.

The bindings handle the cross-product. In markets where chat is permitted with parental consent but memory is prohibited, the API returns the right combination — chat enabled, memory off — without the partner writing per-country code. In markets where the same feature flips between two regimes inside one country (US states, EU member states), the same binding holds.

The harness is age-aware in real time. When a regulator updates a default, when a country adds an AI-specific rule, when a kid has a birthday and ages into a new band, the shipped product behaves correctly the morning the change lands. No redeploy. New laws ship as configuration, not code. The same property the CDK gives gaming and social customers — now extended to every AI surface a partner ships.

What lands in the product

When a partner wires the AI Harness into their CDK integration:

• A verifiable parent link. Teen invites parent → k-ID sends the email → parent verifies identity → parent attaches to the session → partner gets Challenge.StateChange on approval. Either side can unlink later.

• A category-blind alert relay. Partner POSTs an incident on a teen's account; k-ID forwards a partner-authored notice to the verified guardian via email and Family Connect. Schema: incidentId + timestamp + partnerActionsTaken + supportContact. No category, no severity, no content.

• Seven permission IDs writeable from /session/upgrade and readable from /session/get, each with the right default for the user's country and age band, each enforceable on the partner's server.

• Time signals. Session start/stop webhooks, daily and weekly digests to the parent surface, time-limit hooks the partner enforces.

• Family Connect at family.k-id.com. The hosted parent surface, white-labelled per partner. Parent sees what's on, sets preferences, unlinks if they choose.

• An audit trail. Every consent, every alert, every permission change — sourced and timestamped, regulator-shaped from day one.

Same SDK, same auth, same parent surface, same audit trail as every other CDK integration. The AI Harness is the seven new permissions, the alert relay, the activity ingestion, and the AI-vertical defaults — slotted into a kit a partner's engineers may already be using.

The clock the harness is built for

The reason it's shipping with this design and not next year's: the global rules for AI and minors are landing on a calendar.

Australia's Online Safety Amendment Act commenced December 10 2025 — under-16 accounts prohibited on age-restricted platforms. Brazil's ECA Digital took effect March 17 2026 with profiling prohibited under 18. The 2026 COPPA amendments take effect April 22 2026. California's SB 243, Washington's SHB 2225, and California's LEAD for Kids Act AB 1064 all land January 1 2027. The federal GUARD Act is pending. The UK's Children's Code and Online Safety Act, the EU's DSA, New York's Child Data Protection Act, Maryland's Kids Code are already in force.

A bespoke build can't hit four major statutes in eighteen months and the in-flight ones behind them. A configuration on a CDK can.

What changes for AI builders

If you're shipping AI to kids and teens — companion, character, tutor, copilot, creative tool — here's what the AI Harness does for the team behind the product.

Engineering wires one CDK. One auth, one parent surface, one audit trail. Permissions render from the API the way they're configured in the studio — including future ones — so the front-end doesn't break the day a new permission lands.

Trust and safety gets a verified-parent channel for partner-flagged incidents. POST to /alert/push; the right guardian receives the partner-authored notice. Idempotent on incidentId, throttled per session and per partner, with a dead-letter queue and a compliance gap log so nothing gets lost.

Product stops blocking on compliance review for new markets. Brazil isn't a quarter-long project anymore — it's a Compliance Studio configuration. Same for Australia, the UK, California's SB 243, Korea's PIPA. New markets ship as flags.

Legal and privacy see every consent, every assurance check, every permission change in an audit trail with primary sources attached. The judgment calls stay with counsel. The grunt work goes away.

Founders and CEOs get a single answer to "are we compliant for under-18s in the markets we ship in?" The answer is yes, in real time, with the audit trail to prove it.

In market

The AI Harness is shipping across AI experiences serving digital youth. 

One CDK. One integration path. Every market. Every age band. Parents in the loop, in real time.

That's what we're building. AI with character — for digital youth, in every country a family lives in. Starting with the literal kind.

— Kieran

Buildable Issue 04 — A k-ID series on making AI buildable for digital youth, and for the teams shipping to them