diff --git a/apps/server/src/policy/ManagedPolicy.test.ts b/apps/server/src/policy/ManagedPolicy.test.ts
index 9fbe4d2c42791..26e74f05b0372 100644
--- a/apps/server/src/policy/ManagedPolicy.test.ts
+++ b/apps/server/src/policy/ManagedPolicy.test.ts
@@ -11,6 +11,7 @@ import {
 } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 
+import { BUILT_IN_DRIVERS } from "../provider/builtInDrivers.ts";
 import * as ManagedPolicy from "./ManagedPolicy.ts";
 import { disallowedDriverReason, providerHostEnvironment } from "./managedProviders.ts";
 
@@ -349,6 +350,20 @@ it.layer(NodeServices.layer)("ManagedPolicy.load", (it) => {
 
   it.effect("tells clients which drivers run and which instance fields are locked", () =>
     Effect.gen(function* () {
+      // A provider the policy cannot name would also escape its launch-setting rules.
+      const everyDriver = BUILT_IN_DRIVERS.map((driver) => driver.driverKind);
+      const allowingAll = yield* loadFrom(
+        JSON.stringify({
+          schemaVersion: 1,
+          organization: "Example Corp",
+          limits: { providers: { allowedDrivers: everyDriver } },
+        }),
+      );
+      assert.deepEqual<unknown>(
+        allowingAll.summary?.limits?.providers?.allowedDrivers,
+        everyDriver,
+      );
+
       const policy = yield* loadFrom(
         JSON.stringify({
           schemaVersion: 1,
diff --git a/apps/server/src/policy/managedProviders.ts b/apps/server/src/policy/managedProviders.ts
index cbf0f0a1d9b24..5d9ce6aee62d2 100644
--- a/apps/server/src/policy/managedProviders.ts
+++ b/apps/server/src/policy/managedProviders.ts
@@ -19,6 +19,7 @@ import { acpRegistryClient } from "@t3tools/provider-acp-registry/client";
 import { cursorClient } from "@t3tools/provider-cursor/client";
 import { fxClient } from "@t3tools/provider-fx/client";
 import { grokClient } from "@t3tools/provider-grok/client";
+import { kiroClient } from "@t3tools/provider-kiro/client";
 import { museClient } from "@t3tools/provider-muse/client";
 import { openCodeClient } from "@t3tools/provider-opencode/client";
 import { piClient } from "@t3tools/provider-pi/client";
@@ -45,6 +46,7 @@ const PACKAGED_CLIENTS: ReadonlyArray<ProviderClientDefinition> = [
   cursorClient,
   grokClient,
   fxClient,
+  kiroClient,
   museClient,
   openCodeClient,
   piClient,
diff --git a/docs/user/managed-policy.md b/docs/user/managed-policy.md
index e1ba501e6fa3d..6df5375684895 100644
--- a/docs/user/managed-policy.md
+++ b/docs/user/managed-policy.md
@@ -232,7 +232,8 @@ so restart T3 Code after that.
 
 `providers.allowedDrivers` lists the providers that may run, by ID: `codex` (Codex),
 `claudeAgent` (Claude), `cursor` (Cursor), `grok` (Grok), `opencode` (OpenCode), `antigravity`
-(Antigravity), `fx` (fx), `pi` (Pi), `muse` (Muse Code), and `acpRegistry` (ACP Registry).
+(Antigravity), `fx` (fx), `kiro` (Kiro), `pi` (Pi), `muse` (Muse Code), and `acpRegistry` (ACP
+Registry).
 `t3 policy check` rejects an ID this version does not know. Threads on other providers stay,
 marked unavailable, and users can still turn those providers off.