On October 21 we bought harkaq.com and harkaq.ai. We had spent days looking for a Quechua name, three syllables at most, that would say what the product does without having to explain it. That day we found one whose two domains were also free, and we didn’t think twice.
Harkaq is the one who stops. The one who stands at the door and decides what gets through and what doesn’t. Honestly, I can’t think of a better description of what we want to build.
The problem we see every day
Software teams already use AI agents. Claude Code, Codex and others write code and open pull requests. Many times they do it on the developer’s laptop, with the developer’s credentials and access to everything the developer can reach.
In regulated companies, like a bank, that leaves Security with two bad options. Say no, and watch people use agents on their own anyway. Or say yes, and trust that every laptop is configured correctly. Neither one holds up in front of an auditor.
Harkaq exists so there is a third option: saying yes, with control.
What we learned from virtual desktops
Rubén Vergara, my partner and Harkaq’s CEO, founded Blue Ocean, the company that is now BlueSpace, which offers virtual desktops as a service. That company has 3,500 licenses in five countries today and was the first Peruvian ISV on the AWS Marketplace. From that experience he brought something very valuable: years of explaining to managers and auditors why work can happen in a controlled space without people working any worse.
That was always the promise of VDI. The desktop lives somewhere the company controls, people log in from wherever they are, and what comes in and goes out is decided by the organization, not by each device.
Agents need something similar, maybe more urgently. An agent is a tireless worker that reads, runs and sends things to the internet. It needs its own workspace, the same way an outside consultant needs a virtual desktop. That’s where Harkaq brings the VDI promise down to earth: every agent session runs in an isolated cell, with no passwords or keys inside, and everything that leaves goes through a gateway that checks each action, adds the keys without the agent ever seeing them, and logs it.
Control, not a straitjacket
This is, I think, the hardest part. A security tool that blocks everything is easy to build and nobody uses it. Within a month, developers find a way around it, and the company is blind again.
That’s why Harkaq is not a list of prohibitions. Inside its cell, the agent works freely: it edits the code and runs its tests. When it needs something outside the policy, say a new library, it asks. The request goes to someone else, who sees exactly what was asked and why, and decides. If they say yes, the permission is for that session and expires on its own.
This way the organization gradually allows what it actually needs, with a record of who approved it, instead of having to guess everything on day one.
Where we come from
I come from engineering and software vendors. I’m a computer engineer from PUCP, and I spent more than fifteen years in cloud and infrastructure for banking at Oracle, VMware, NetApp and IBM. That’s where I learned how a bank buys, what its auditors ask, and why a good technology can wait months for a signature.
In recent years I’ve built products with AI agents, like Nada Menos. Working this way changed how I build software. It also showed me up close what an agent can do when nobody stops it: read a secret it shouldn’t have, or push code to the wrong place. None of that is malice; it’s a very fast worker without supervision.
Rubén knows how to sell a controlled workspace to large companies. I know how to build with agents, and I know the customers who want to use them. That’s why we decided to do this together.
What comes next
Harkaq will be a cloud service. We’re starting with what’s already happening: coding agents like Claude Code and Codex, in software teams at regulated companies in Peru and Chile. After that will come agents that work with business data, for analysts and teams that don’t write code.
On this blog we’ll share how we’re building it, what we’re learning, and which security decisions we make and why. I’ll be the one writing, and I’ll try to do it with concrete examples, because that’s how things are best understood.
For me, Harkaq comes down to something simple: companies don’t have to choose between using AI agents and sleeping at night. What’s missing is someone who stops things at the door, and that’s what we’re going to build.