Kastra

Product Introduction

1. Definition: Kastra is a runtime authorization layer and policy decision point (PDP) for AI systems. It is a specialized infrastructure component designed to intercept and evaluate actions generated by AI agents, models, and copilots before execution.
2. Core Value Proposition: Kastra exists to provide deterministic, pre-execution governance for AI agent actions. It prevents unauthorized tool use, prompt injection, data exfiltration, and destructive operations by enforcing security and compliance policies with sub-1 millisecond latency, bridging the critical security gap between AI decision-making and real-world system interaction.

Main Features

1. Runtime Authorization (PDP): This is the core engine that evaluates every AI-proposed action—such as a shell command, database query, API call, or browser interaction—against a centralized policy. It performs a four-stage check: verifying the AI agent's identity, evaluating the action's scope, applying specific guardrails, and signing the decision to an immutable audit log. The entire decision pipeline operates with a p99 latency of under 1 millisecond.
2. Unified Policy Engine (DSL): Kastra uses a single, typed policy-as-code language that works across all enforcement points. Policies are versioned, reviewable, and define precise rules for identity, resource scope, and guardrails (e.g., blocking rm -rf on certain paths or requiring human approval for financial transactions). This ensures consistent governance whether enforcing on a developer's laptop (Kastra Edge) or in a cloud-based agent runtime.
3. Provenance and Audit Trail: Every authorization decision is cryptographically signed using ed25519 and appended to an immutable, replayable audit vault. This creates a verifiable chain of custody for all AI actions, enabling streaming to SIEM systems like Datadog or Splunk, and providing essential evidence for compliance frameworks like SOC 2, ISO 27001, HIPAA, and the EU AI Act.
4. Hybrid Enforcement Architecture: Kastra deploys consistently across multiple environments. Kastra Edge is a local daemon for governing AI coding assistants (Claude Code, Cursor, Codex CLI) on developer laptops. The Cloud Control Plane manages policies and decisions for backend AI agents. This allows for a "govern everywhere" strategy with a single policy language.
5. Post-Inference Validation: Beyond tool calls, Kastra can inspect and validate the structured outputs (inferences) from AI models before those outputs are used by downstream applications. This acts as a final guardrail against prompt injection or data leakage attempts that might bypass initial checks.
6. Kastra Recon: A unique risk assessment module that scans the historical activity logs of AI agents (e.g., from Claude Code or Cursor) to identify past risky actions—like secret exposure or force pushes—and automatically drafts corresponding enforcement policies, enabling a "audit first, enforce next" workflow.

Problems Solved

1. Pain Point: The absence of a runtime authorization layer for AI agents creates ungoverned access to critical systems. AI can execute destructive shell commands, query sensitive databases, or initiate financial transactions without a pre-execution policy check, leading to security incidents and compliance failures.
2. Target Audience: Platform and security engineers at enterprises deploying AI; developers building with AI agent frameworks (e.g., using Anthropic/OpenAI SDKs, LangChain); DevOps teams managing AI-powered tooling; compliance officers in regulated industries (finance, healthcare, government); and indie developers building agentic applications.
3. Use Cases: Governing AI coding assistants to prevent rm -rf or exposure of secrets; controlling autonomous browser agents (like OpenClaw) from performing unapproved financial transactions; scoping database access for AI research agents to comply with data residency rules (e.g., GDPR); enforcing human-in-the-loop checkpoints for high-stakes actions in multi-step AI workflows; and providing signed audit trails for AI actions to pass security audits.

Unique Advantages

1. Differentiation: Unlike post-hoc monitoring or observability tools, Kastra is a proactive enforcement layer that decides before an action runs. Unlike generic LLM content filters or chatbot moderation tools, it focuses on the security and compliance of actions and tool use at the infrastructure level, not on conversational content.
2. Key Innovation: The integration of a high-performance, sub-millisecond Policy Decision Point (PDP) specifically designed for the latency-sensitive loop of AI agent operation. This, combined with its hybrid deployment model (Edge + Cloud) and its deep, pre-execution integrations with tools like Claude Code, Cursor, and OpenClaw, provides a unique "runtime authorization" primitive missing from the AI infrastructure stack.

Frequently Asked Questions (FAQ)

1. What is the difference between Kastra and LLM guardrails? LLM guardrails typically filter input prompts or output text for safety and content policy violations. Kastra is a runtime authorization system that governs the actions an AI attempts to perform—like shell commands, API calls, and database queries—enforcing security and compliance policies before the action executes on a real system.
2. How does Kastra achieve sub-millisecond latency for authorization decisions? Kastra's policy decision point is built as a high-performance, purpose-built engine that evaluates policies against a structured action context. It avoids heavyweight processes, uses efficient evaluation pipelines, and is optimized for the low-latency requirements of interactive AI agent loops, consistently delivering p99 decision times under 1ms.
3. Can Kastra work with AI agents running on isolated or air-gapped networks? Yes, Kastra supports self-hosted and air-gapped deployment models. The entire control plane, including the policy engine and audit vault, can be deployed within a private network, ensuring that sensitive AI actions and decision logs never leave the internal environment while maintaining the same enforcement capabilities.
4. How does Kastra handle governance for autonomous AI agents with long-running workflows? Kastra provides agent.scope controls that can scope permissions for each step of a multi-step autonomous agent. It can enforce session-based allowlists and designate specific high-risk actions (e.g., "submit wire transfer") as checkpoints that pause the agent and require signed, audited human approval before proceeding.
5. Is Kastra compatible with the Model Context Protocol (MCP)? Yes, Kastra offers MCP integration, allowing it to govern the tools and resources that AI agents access via MCP servers. This provides a standardized method to enforce authorization policies on the growing ecosystem of context-augmented AI applications.