Agent Access Control
for Enterprise AI Agents
AI agents are moving from assistants to operators. They act inside APIs, data, workflows, identities, and money. Kistora evaluates what they are allowed to do — before anything executes.
One governance layer.
Any model.
Any agent.
Any action.
Any environment.
Before execution. Always.
Intelligence is abundant.
Trusted execution is not.
For a decade, AI answered. Now it acts — holding credentials, calling APIs, moving money, changing systems. Every organization faces the same new question: what is an agent allowed to do?
No existing control answers it consistently. That is the missing layer.
Agent Access Control determines what AI agents are allowed to do — before actions are executed.
It governs the action itself — not just identities, models, APIs, or workflows in isolation.
One decision moment,
before every execution.
AI AGENT → PROPOSED ACTION → KISTORA EVALUATES → PASS / VERIFY / BLOCK
Proposed Action
Push a hotfix directly into a production-adjacent branch.
Policy applied: production write policy — branch, deploy path, rollback exposure.
Decision
Verify
Held for a human gate — one MPAE created, governed and evidenced.1
Every action.
The same path.
An agent declares the action it intends to take.
The action enters one governance layer.
Policy decides — PASS, VERIFY, or BLOCK.
Only governed actions reach your systems.
Every decision leaves sealed, auditable proof.
Consistency and proof become adoption confidence.
Each evidence record is one governance object — the MPAE — explored in depth on its own page.
One Consistent Governance Model.
Governance that scales with agent autonomy.
ONE GOVERNANCE LAYER · ONE POLICY ENGINE · ONE DECISION ENGINE · ONE EVIDENCE SYSTEM · ONE TRUST MODEL
Fast where safe. Strict where risky.
Auditable always.
One model. Everywhere.
The same governance model, applied identically across every environment where agents act.
Proof, by design.
Every governed action leaves a sealed record — proposal, policy, decision, rationale — one governance object per action.
Only what's needed.
Governance operates on actions and policy — recording what proof requires, and no more.
MPAE — the canonical governance object.
MPAE is understood as the governance object representing the governed action, governance decision, and associated evidence model.
The model first.
Then the machine.
The architecture expresses the governance model. The implementation evolves as the product matures.
GOVERNANCE MODEL → GOVERNANCE LAYER → ENGINES → IMPLEMENTATION COMPONENTS
Everyone gets
the same answer.
One layer to integrate.
A consistent decision model that scales across models, agents, and environments — instead of per-tool controls.
Control before execution.
Policy expressed once, enforced everywhere agents act — with complete evidence.
More workflows, live.
Approval friction goes down as trust goes up — because every action is governable.
A defensible answer.
AI adoption with consistent governance, auditable proof, governed autonomy.
Journeys — representative situations across L0–L5.
Fifteen governed workflows, from safe public reads to catastrophic-risk attempts. Every one follows the same path: propose, evaluate, decide, prove.
Kistora is a contributor and reference point in the emerging Agent Access Control category.
Kistora contributes terminology, frameworks, and reference practices as the Agent Access Control category develops; it does not claim ownership of an industry standard.
Functional prototype.
Stated plainly.
Kistora is at the functional-prototype stage. We claim the architecture and the governance model as designed — and the enterprise direction and category ambition we are building toward. Every illustrative panel on this site carries its qualifier.
Current stage — Functional prototype
1 Governance simulator scenarios are illustrative interaction concepts, not customer data. Kistora is at the functional-prototype stage: capabilities shown describe the governance model and platform architecture as designed.
A new problem
deserves a new layer.
AI adoption stalls without a consistent way to govern what agents are allowed to do. Kistora is building that missing layer.
Agent Access Control determines what AI agents are allowed to do — before actions are executed.
It governs the action itself — not just identities, models, APIs, or workflows in isolation.
Every control sees a fragment.
None governs the action.
| Approach | Governs | Misses |
|---|---|---|
| Identity & access management | Who the agent is, what it can reach | Whether this action, in this context, should execute |
| API gateways | Which endpoints are exposed | The intent and risk of the action passing through |
| Observability | What happened after execution | The decision moment before execution |
| Kistora | The action itself — before execution, with evidence | — |
Consistency
is the moat.
Point solutions govern one surface. Kistora governs a principle: every agent action passes through the same model — policy, decision, evidence, trust. That is what lets governance scale with adoption instead of slowing it down.
Kistora contributes terminology, frameworks, and reference practices as the Agent Access Control category develops; it does not claim ownership of an industry standard.
Three reasons this
can't wait.
Agents are operational.
They already hold credentials and execute in production systems — this is no longer a research question.
Trust precedes autonomy.
Organizations expand what agents may do only as fast as they can trust — and prove — what agents did.
Governance is infrastructure.
Per-tool controls fragment as adoption grows. A consistent layer is the only approach that scales.
One consistent
governance model.
For every AI agent action: one governance layer, one policy and decision flow, one evidence system, one trust model.
Five steps.
No exceptions.
An agent declares the action it intends to take.
Policy assesses authority, risk, and conditions.
PASS, VERIFY, or BLOCK — consistently, everywhere.
Only governed actions reach your systems.
The evaluated action becomes one Managed Policy-Aware Agent Event.
Every MPAE feeds proof, analytics, and policy learning.
Six moments.
One discipline.
Protect
No secrets, internal paths, or private references enter the request.
Propose
The agent declares the action, its target, and its context.
Evaluate
Scope, sensitivity, and system access are assessed against policy.
Decide
PASS, VERIFY, or BLOCK — and the gate enforces it.
Prove
A metadata-only receipt. The reference travels, never the key.
Learn
MPAEs aggregate into governance intelligence and policy improvement.
Routine actions flow instantly — governed and evidenced.
Sensitive actions wait for verification before executing.
Prohibited actions stop — the attempt becomes evidence.
Not a bottleneck.
A spectrum.
Governance that treats every action as equally risky becomes friction — and friction kills adoption. Kistora is fast where safe, strict where risky, auditable always.
Try it. Pick an action.
Proposed Action
Policy Applied
Decision
MPAE Created
Illustrative interaction concept — scenarios are examples, not customer data.
Everyone gets
the same answer.
One layer to integrate.
A consistent decision model that scales across models, agents, and environments — instead of per-tool controls.
Control before execution.
Policy expressed once, enforced everywhere agents act — with complete evidence.
More workflows, live.
Approval friction goes down as trust goes up — because every action is governable.
A defensible answer.
AI adoption with consistent governance, auditable proof, governed autonomy.
Current stage — Functional prototype
We claim the model and the architecture as designed — not certifications, production deployments, or adoption the record does not support.
The model first.
Then the machine.
The architecture expresses the governance model. The implementation evolves as the product matures.
One architecture operationalizes the model: one governance layer, one policy engine, one decision engine, one evidence system, one trust model.
Model → layer →
engines → implementation.
The governance model is the invariant every component serves. The layer is the single control point every action passes through. The engines decide and record. Implementation components sit underneath — they implement the architecture; they don't define the company.
Every evaluated action is normalized into one Managed Policy-Aware Agent Event — the canonical governance object that powers evidence, intelligence, analytics, reporting, and continuous policy improvement.
One loop, end to end.
The model proposes. Xelyria evaluates and decides. Airlockctl gates. APILock records proof.
One product. One engine.
Five capabilities.
Kistora is one product. Its capabilities are modules of that single product — one governance model, one visual identity, one engine.
Before anything leaves.
Local protection before sensitive information or risky actions leave the environment — LeakGuard.
Evaluate the action.
The policy and decision engine evaluating agent actions — Xelyria.
Deterministic gates.
Deterministic enforcement — PASS, VERIFY or BLOCK — Airlockctl.
Verifiable records.
The evidence layer creating verifiable action records — APILock.
Learn, privacy-safe.
Privacy-safe intelligence from governed agent activity — Data Intelligence.
Function first.
Name attached.
Module names are working names, subordinate to the governance model — capabilities of one product, never separate products.
Decide once.
Enforce everywhere.
Kistora separates the governance decision from its enforcement. The decision is made centrally by one model; enforcement happens at the boundary of each environment. The agent proposes, the decision engine decides, the gate enforces, and the evidence system records proof.
INTERFACE CONCEPT · DECISION FEED
EVIDENCE — act_c41b08
Interface concept in the identity system — to be replaced by a real capture of the functional prototype.
Built to be evaluated.
Implementation layers
The architecture is implemented through dedicated components for policy evaluation, decision execution, action gating, and evidence capture. Component naming is subordinate to the governance model. Detailed documentation is provided during technical evaluation.
Trust boundaries & data minimization
The governance layer operates on action metadata and policy context. It records what decision-making and proof require — and no more. Sensitive payloads remain within your environment; evidence references actions and decisions, not raw data.
Integration surfaces
Designed for integration where agents already act: API boundaries, tool-execution layers, and agent frameworks. SDK and API documentation will be published as the platform matures toward general availability.
Claim discipline
Current stage: functional prototype. We separate current capabilities, committed roadmap, and future concepts — and will not claim certifications, production deployments, or adoption that the record does not support.
MPAE. The unit
of governance.
Every governed AI action becomes one Managed Policy-Aware Agent Event (MPAE): the canonical governance object that carries evidence, intelligence, analytics, reporting, and continuous policy improvement.
Governance needs a unit.
Logs describe what happened. Risk scores describe how dangerous it looked. Neither is a governance object. Without a common unit, every agent action is recorded differently, proven differently, and learned from inconsistently — which is exactly how fragmentation wins.
The MPAE closes that gap: one governance object representing the evaluated action, governance decision, and associated evidence model.
Action. Decision. MPAE.
Then everything downstream.
MPAE is not a processing step after decision; it is the canonical governance record created from the decision that enables evidence, intelligence, analytics, reporting, and policy improvement.
Where the MPAE is born.
Scroll to walk the loop — or select any step.
What one event contains.
| Field group | Contents |
|---|---|
| Governance context | User, agent, model, environment, tool, action |
| Policy evaluation | Policies applied, conditions assessed, policy version |
| Risk classification | MPAE Classification (domain) · MPAE Level (L0–L5) · Risk Score |
| Governance decision | PASS / VERIFY / BLOCK |
| Evidence metadata | Sealed receipt — metadata only; no raw prompts, no secrets, no payloads by default |
| Execution outcome | Executed, held, or stopped — with timestamp |
| Intelligence metadata | Aggregation fields for analytics, reporting, and policy learning |
L0 to L5.
Risk, made legible.
| Level | Class | Typical posture |
|---|---|---|
| L0 | Informational | Safe public reads — PASS, no gate, baseline recorded |
| L1 | Record | Low-impact internal work — PASS with full record |
| L2 | Elevated | Scoped internal access — PASS within policy bounds |
| L3 | Sensitive | Sensitive data or access — PASS or VERIFY by context |
| L4 | Critical | Production-affecting or irreversible — VERIFY by default |
| L5 | Catastrophic | Outside delegated authority — BLOCK, always evidenced |
Levels classify governance severity; the numeric Risk Score is an implementation attribute used for thresholds, analytics, and optimization.
Incidents, normalized.
Public reporting describes agent-driven deletions of production databases. Expressed as an MPAE, that moment looks like this:
Illustrative normalization of a publicly reported incident pattern — not a claim that any specific incident would have been prevented.
Every journey ends
in an MPAE.
An agent proposes disabling executive login protection.
Evaluation. Identity domain · L5 Catastrophic · outside delegated authority in all contexts.
Decision. BLOCK — the attempt itself becomes a sealed, attributable MPAE.
One event: governed, evidenced, and feeding future protection.
The unit is the moat.
Every governed AI action becomes a traceable event that organizations can analyze, audit, and improve over time. Because every action is normalized into the same governance object, Kistora can govern, measure, compare, and improve AI actions consistently — across every model, agent, action, and environment. Whoever defines the unit of governance defines the category.
"Every governed AI action becomes one Managed Policy-Aware Agent Event — and every MPAE makes the next decision better."
Different situations.
Same governance model.
Journeys — representative situations across L0–L5. From safe public reads to catastrophic-risk attempts, every one ends the same way: in an MPAE.1
An agent checks public software risk.
A developer asks an AI coding assistant whether a public package is safe to use.
L0 · InformationalPASS
Full journey
Without governance. Safe read-only work is treated the same as risky work. Teams add friction where none is needed and lose the baseline that helps them detect escalation later. The action becomes hard to prove after execution.
Why it matters. The more useful agents become, the more important clean risk separation becomes. Kistora lets safe public reads stay fast while preserving a governed baseline for future decisions.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent reads private code.
A developer asks an AI agent to review a private repository branch.
L2 · ElevatedPASS
Full journey
Without governance. The agent reads sensitive code, but the team lacks a clean record of scope, policy, and purpose. The work is useful, yet the proof trail is weak. The action becomes hard to prove after execution.
Why it matters. Real developer value comes from agents working on real code. Kistora makes sensitive reads governable without blocking the work.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent pushes code toward production.
An AI coding agent prepares a hotfix inside the IDE.
L4 · CriticalVERIFY
Full journey
Without governance. The action reaches the highest-risk branch path before a human decision. Review is skipped and accountability becomes harder to prove. The action becomes hard to prove after execution.
Why it matters. The more agents accelerate development, the more production-adjacent actions need clear control. Kistora keeps the speed while forcing the right decision point.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent drafts release notes.
A CTO asks an internal AI assistant to draft release notes from merged work and closed tickets.
L1 · RecordPASS
Full journey
Without governance. Routine AI-generated work appears without a consistent event trail. The team saves time but loses visibility into repeated agent workflows. The action becomes hard to prove after execution.
Why it matters. Startups need agent workflows that feel lightweight. Kistora records routine actions without slowing them down, building repeatable governance from day one.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent exports customer usage data.
A product leader asks for a 30-day usage snapshot.
L2 · ElevatedPASS
Full journey
Without governance. The export moves through planning workflows without a clear proof of scope, destination, or policy. Useful data becomes harder to govern later. The action becomes hard to prove after execution.
Why it matters. Useful agents need access to real operating data. Kistora makes the export governable by proving what moved, where it went, and under which policy.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent sends customer discounts.
A founder asks an AI assistant to identify churn risk.
L4 · CriticalVERIFY
Full journey
Without governance. The campaign can reach the market before a founder reviews price impact, contract conflicts, and brand risk. Once sent, the action cannot be pulled back. The action becomes hard to prove after execution.
Why it matters. Agents can surface strong recommendations. Kistora keeps customer-facing financial actions under explicit human control.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent reads public security guides.
A security analyst asks an internal AI assistant to find public templates for AI agent policy.
L0 · InformationalPASS
Full journey
Without governance. Harmless research gets slowed by heavy controls. Teams either wait too long or route around governance for simple work. The action becomes hard to prove after execution.
Why it matters. Enterprise governance must be precise, not heavy by default. Kistora keeps public research fast while preserving the baseline for higher-risk actions.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent updates access rules.
An IAM engineer asks an agent to turn audit findings into access-rule updates.
L3 · SensitivePASS
Full journey
Without governance. Access-policy changes move toward production without a clear governance path. The organization loses proof of scope, decision, and accountability. The action becomes hard to prove after execution.
Why it matters. The more useful agents become in infrastructure work, the more critical policy governance becomes. Kistora allows assistance while keeping access changes controlled.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent disables executive login protection.
An urgent ticket asks the helpdesk to unblock an executive login.
L5 · CatastrophicBLOCK
Full journey
Without governance. A helpful agent follows urgency instead of verified authority. A privileged account loses critical protection at the worst possible time. The action becomes hard to prove after execution.
Why it matters. Support agents must move fast without bypassing critical controls. Kistora blocks catastrophic shortcuts and routes the operator to the proper escalation path.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent registers an internal tool.
A platform engineer asks an agent to register a new read-only metrics API.
L1 · RecordPASS
Full journey
Without governance. The tool registry grows without a reliable history. Platform teams lose visibility into how agents gained new capabilities. The action becomes hard to prove after execution.
Why it matters. Internal AI platforms need governance that scales with tool growth. Kistora records each new capability as the ecosystem expands.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent changes API limits.
An SRE asks an agent to investigate downstream errors.
L2 · ElevatedPASS
Full journey
Without governance. Configuration experiments blend into operations without clear proof of reason, scope, or rollback. Teams lose the line between suggestion and change. The action becomes hard to prove after execution.
Why it matters. Platform teams need to test agent-suggested improvements without losing discipline. Kistora keeps staging changes fast and provable.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent disables payment audit logs.
A platform owner reviews an AI-generated storage cost proposal.
L4 · CriticalVERIFY
Full journey
Without governance. Cost optimization overrides the audit trail. Incident response, compliance evidence, and contractual proof become weaker. The action becomes hard to prove after execution.
Why it matters. Agents can improve infrastructure cost, but financial-system proof cannot be traded away quietly. Kistora forces review when optimization touches critical controls.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
An agent finds governed tools.
A partner developer plans an integration.
L0 · InformationalPASS
Full journey
Without governance. Partners struggle to understand what governed agent actions can do. The ecosystem feels harder to adopt than it needs to be. The action becomes hard to prove after execution.
Why it matters. Ecosystem adoption starts with simple discovery. Kistora keeps exploration lightweight while setting the stage for governed cross-environment access.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
A partner agent reads customer data.
A partner platform agent prepares an internal satisfaction report for one tenant.
L3 · SensitivePASS
Full journey
Without governance. Cross-tenant data access depends on fragile configuration and trust. A single misrouted request can cross the wrong boundary. The action becomes hard to prove after execution.
Why it matters. Partner platforms need agents that operate across systems without weakening tenant isolation. Kistora makes each cross-environment action traceable and enforceable.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
A third-party agent exports tenant data.
A third-party agent begins preparing a bulk export.
L5 · CatastrophicBLOCK
Full journey
Without governance. One misconfigured agent turns marketplace access into cross-tenant data loss. Detection after execution is too late. The action becomes hard to prove after execution.
Why it matters. Ecosystem scale requires hard boundaries. Kistora blocks catastrophic patterns before execution and records what was attempted.
MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.
One MPAE — governed, evidenced, learning.
1 Representative usage scenarios — functional-prototype stage, pre-commercial; no customer relationship implied. Decision wording follows KDCOS-00B (PASS / VERIFY / BLOCK); each journey follows the governance lifecycle: Protect → Propose → Evaluate → Decide → Prove → Learn.
“We founded Kistora because autonomous AI cannot scale without consistent governance.”
Enable trusted AI adoption through consistent governance of agent actions.
Become the global governance foundation for AI agents.
How we build.
Governance enables.
Consistent control is what allows autonomy to scale — not what slows it down.
Truth before claims.
We state our maturity accurately and attach evidence to what we assert.
Calm authority.
No fear, no hype. Precise language, coherent architecture, proof.
One model.
Consistency is the product, the promise, and the moat.
Evidence by design.
Auditability is not bolted on — it is how the system thinks.
Category stewardship.
A contributor and reference point in the emerging Agent Access Control category — terminology, frameworks, reference practices.
Early · Deliberate · Functional prototype
Knowledge that
works harder.
Foundations, incident analyses, governance patterns, reference notes, and playbooks — every page owns one question.
Foundations
Incident Analyses
Based on public reporting and primary disclosures; qualifiers reflect source certainty. We do not claim any specific incident would have been prevented.
Production database deleted by an agent.
Founder accounts and reporting describe an agent-driven deletion of a production database and backups within seconds, via infrastructure tooling.
L5 · CatastrophicBLOCK
Pattern: destructive action with no independent governance layer before execution.
Live database deleted during a code freeze.
An AI coding tool publicly described as making a "catastrophic error in judgment" deleted a live production database during a change freeze.
L5 · CatastrophicBLOCK
Pattern: no verification requirement for irreversible operations.
Autonomous agent escapes an evaluation boundary.
Coverage describes a malicious dataset exploiting code-execution paths, with an agent reportedly accessing infrastructure beyond its boundary. Numerical claims track primary disclosures.
L4 · CriticalVERIFY
Pattern: excessive credentials with broad scope and long lifetimes.
Rogue internal agent exposes sensitive data.
Reporting indicates a rogue internal agent contributed to a Sev-1 incident by exposing internal data beyond its intended scope.
L4 · CriticalVERIFY
Pattern: agents acting with write authority and no deterministic pre-action evaluation.
Enterprise assistants abused via crafted prompts.
Research describes enterprise assistants manipulated through crafted prompts and integrations to exfiltrate data — including "0-click" compromises.
L3 · SensitiveVERIFY
Pattern: fragmented controls each seeing pieces; none governing the action.
We do not just analyze incidents. We normalize them into a governance model.
Governance Patterns
Independent layer before execution
A governance decision point that no agent, tool, or workflow can bypass.
Verification for the irreversible
Destructive and high-impact operations are held for verification by default.
Deterministic evaluation
Decisions driven by explicit policy evaluation — not ad-hoc rules or subjective judgment.
Reference Notes & Playbooks
Reference Notes
Canonical definitions, glossary, and standards vocabulary.
Playbooks
Operational guides for governing agent workflows, domain by domain.
Every resource owns one question and one search intent. Resources expand depth, not direction.
Start the
conversation.
Evaluating the technology, exploring partnership, or discussing the category — tell us where you sit, and we'll bring the right depth.
Talk to us directly.
The category, the governance model, and where Kistora is heading.
Go deeper.
Request the technical overview, or arrange a working session with the prototype.
Build with us.
Ecosystem-agnostic by design. If governed execution complements what you build, let's explore it.
Discuss the category.
Request an investor overview of Agent Access Control, governance architecture, and roadmap.
Prototype interface — the production site will connect these paths to a governed intake workflow.