Kavikah-vee
Writes the rules that decide which software may run on a Windows device.
Named for Kaveh, the blacksmith who stood up to a tyrant in Persia’s Book of Kings.
After a hotel or club door book: Kavi writes the list, a person signs it, and the device lets in only who is on it.
Why I built it
At work, writing the rules for one app took a skilled engineer three to five hours by hand. A vendor’s tool would have cost far more every year, and locked the firm in.
It seemed worth fixing, so I built Kavi in my own time and shared it with my colleagues. Now it takes minutes.
What a reported cybercrime costs an Australian business, on average. ASD, 2024–25
Why now
Most security tools block only software they already know is bad, so anything new slips through, like a script written in seconds with artificial intelligence. An allow list runs only what someone approved. Australia’s cyber agency rates it one of the most effective defences.
How it works
CodePerson
Code and a person. No model runs in it.
-
Capture
Scan a folder, capture an installer, or watch what Windows would block. Every file is recorded.
Code -
Recommend
The narrowest rule each file’s risk allows, with the reason beside it.
Code -
Consolidate
Files signed by the same maker share one rule: in setup.msi, 38 files from two makers need only 2.
Code -
Review
A person goes through the grid and can override any rule.
Person -
Generate
Microsoft’s own tools write the policy, ready to check and send.
Code -
Hand off
Intune sends it to the computers. Kavi never deploys anything itself: a bad policy can stop a computer starting.
PersonKavi stops here
Built with
- Size
- 7,600 lines of C#.
- Next
- A desktop app today, with a web version in progress. Then packaging apps as well as writing their rules.
The rule it follows
Give each program the narrowest rule that works. Never widen one to save time.