Agent intents converging into one governance layer and leaving as ordered, evidenced flows
A new category

Agent Access Control
for Enterprise AI Agents

AI agents are moving from assistants to operators. They act inside APIs, data, workflows, identities, and money. Kistora evaluates what they are allowed to do — before anything executes.

ILLUSTRATIVE · LATEST MPAEs registry.read · public package · ● PASS repo.push · production-adjacent · ● VERIFY identity.mfa_disable · executive · ● BLOCK

One governance layer.
Any model. Any agent.
Any action. Any environment.
Before execution. Always.

The shift

Intelligence is abundant.
Trusted execution is not.

For a decade, AI answered. Now it acts — holding credentials, calling APIs, moving money, changing systems. Every organization faces the same new question: what is an agent allowed to do?

No existing control answers it consistently. That is the missing layer.

Why this needs a new answer

ANSWERS AGENT PAYMENTS DATA INFRASTRUCTURE IDENTITY ACTIONS
The definition

Agent Access Control determines what AI agents are allowed to do — before actions are executed.

It governs the action itself — not just identities, models, APIs, or workflows in isolation.

Explore the category

The decision

One decision moment,
before every execution.

AI AGENT  →  PROPOSED ACTION  →  KISTORA EVALUATES  →  PASS / VERIFY / BLOCK

Kistora — Governance Layer

Proposed Action

Push a hotfix directly into a production-adjacent branch.

Policy applied: production write policy — branch, deploy path, rollback exposure.

Decision

Verify

Held for a human gate — one MPAE created, governed and evidenced.1

Explore the decision moment

How it works

Every action.
The same path.

01Agent proposes

An agent declares the action it intends to take.

02Governance evaluates

The action enters one governance layer.

03Decision

Policy decides — PASS, VERIFY, or BLOCK.

04Execution

Only governed actions reach your systems.

05Evidence created

Every decision leaves sealed, auditable proof.

06Trust compounds

Consistency and proof become adoption confidence.

Each evidence record is one governance object — the MPAE — explored in depth on its own page.

The invariant

One Consistent Governance Model.

Governance that scales with agent autonomy.

ONE GOVERNANCE LAYER  ·  ONE POLICY ENGINE  ·  ONE DECISION ENGINE  ·  ONE EVIDENCE SYSTEM  ·  ONE TRUST MODEL

Consistency

One model. Everywhere.

The same governance model, applied identically across every environment where agents act.

Evidence

Proof, by design.

Every governed action leaves a sealed record — proposal, policy, decision, rationale — one governance object per action.

Privacy

Only what's needed.

Governance operates on actions and policy — recording what proof requires, and no more.

The governance object

MPAE — the canonical governance object.

MPAE is understood as the governance object representing the governed action, governance decision, and associated evidence model.

Understand MPAE

The architecture

The model first.
Then the machine.

The architecture expresses the governance model. The implementation evolves as the product matures.

GOVERNANCE MODEL  →  GOVERNANCE LAYER  →  ENGINES  →  IMPLEMENTATION COMPONENTS

Discover the architecture

Outcomes

Everyone gets
the same answer.

Platform & Engineering

One layer to integrate.

A consistent decision model that scales across models, agents, and environments — instead of per-tool controls.

Security & Risk

Control before execution.

Policy expressed once, enforced everywhere agents act — with complete evidence.

Operations & Product

More workflows, live.

Approval friction goes down as trust goes up — because every action is governable.

Executives

A defensible answer.

AI adoption with consistent governance, auditable proof, governed autonomy.

See outcomes by role

Journeys

Journeys — representative situations across L0–L5.

Fifteen governed workflows, from safe public reads to catastrophic-risk attempts. Every one follows the same path: propose, evaluate, decide, prove.

Explore the journeys

Knowledge

Kistora is a contributor and reference point in the emerging Agent Access Control category.

Kistora contributes terminology, frameworks, and reference practices as the Agent Access Control category develops; it does not claim ownership of an industry standard.

Visit the Governance Library

Where we are

Functional prototype.
Stated plainly.

Kistora is at the functional-prototype stage. We claim the architecture and the governance model as designed — and the enterprise direction and category ambition we are building toward. Every illustrative panel on this site carries its qualifier.

Current stage — Functional prototype

The future is not
autonomous AI.

It's governed autonomy.

Investors — request an investor overview of Agent Access Control, governance architecture, and roadmap.

1 Governance simulator scenarios are illustrative interaction concepts, not customer data. Kistora is at the functional-prototype stage: capabilities shown describe the governance model and platform architecture as designed.

Why Agent Access Control

A new problem
deserves a new layer.

AI adoption stalls without a consistent way to govern what agents are allowed to do. Kistora is building that missing layer.

The definition

Agent Access Control determines what AI agents are allowed to do — before actions are executed.

It governs the action itself — not just identities, models, APIs, or workflows in isolation.

The gap

Every control sees a fragment.
None governs the action.

AGENT EXECUTION IDENTITY API GATEWAY OBSERVABILITY · AFTER THE FACT — UNGOVERNED — AGENT ACCESS CONTROL · BEFORE EXECUTION · THE WHOLE BOUNDARY
ApproachGovernsMisses
Identity & access managementWho the agent is, what it can reachWhether this action, in this context, should execute
API gatewaysWhich endpoints are exposedThe intent and risk of the action passing through
ObservabilityWhat happened after executionThe decision moment before execution
KistoraThe action itself — before execution, with evidence
The claim

Consistency
is the moat.

Point solutions govern one surface. Kistora governs a principle: every agent action passes through the same model — policy, decision, evidence, trust. That is what lets governance scale with adoption instead of slowing it down.

Kistora contributes terminology, frameworks, and reference practices as the Agent Access Control category develops; it does not claim ownership of an industry standard.

Why now?

Three reasons this
can't wait.

01

Agents are operational.

They already hold credentials and execute in production systems — this is no longer a research question.

02

Trust precedes autonomy.

Organizations expand what agents may do only as fast as they can trust — and prove — what agents did.

03

Governance is infrastructure.

Per-tool controls fragment as adoption grows. A consistent layer is the only approach that scales.

How Decisions Are Made

One consistent
governance model.

For every AI agent action: one governance layer, one policy and decision flow, one evidence system, one trust model.

One path reaching a decision point and splitting three ways: pass, verify, block
How it works

Five steps.
No exceptions.

01Agent proposes

An agent declares the action it intends to take.

02Governance evaluates

Policy assesses authority, risk, and conditions.

03Decision

PASS, VERIFY, or BLOCK — consistently, everywhere.

04Execution

Only governed actions reach your systems.

05MPAE created

The evaluated action becomes one Managed Policy-Aware Agent Event.

06Evidence & intelligence

Every MPAE feeds proof, analytics, and policy learning.

The governance lifecycle

Six moments.
One discipline.

Protect · LeakGuard

Protect

No secrets, internal paths, or private references enter the request.

Propose · Agent

Propose

The agent declares the action, its target, and its context.

Evaluate · Xelyria

Evaluate

Scope, sensitivity, and system access are assessed against policy.

Decide · Xelyria + Airlockctl

Decide

PASS, VERIFY, or BLOCK — and the gate enforces it.

Prove · APILock

Prove

A metadata-only receipt. The reference travels, never the key.

Learn · MPAE

Learn

MPAEs aggregate into governance intelligence and policy improvement.

Pass

Routine actions flow instantly — governed and evidenced.

Verify

Sensitive actions wait for verification before executing.

Block

Prohibited actions stop — the attempt becomes evidence.

The spectrum

Not a bottleneck.
A spectrum.

Governance that treats every action as equally risky becomes friction — and friction kills adoption. Kistora is fast where safe, strict where risky, auditable always.

The decision moment

Try it. Pick an action.

Kistora — Governance Layer

Proposed Action

Policy Applied

Decision

MPAE Created

Illustrative interaction concept — scenarios are examples, not customer data.

Outcomes

Everyone gets
the same answer.

Platform & Engineering

One layer to integrate.

A consistent decision model that scales across models, agents, and environments — instead of per-tool controls.

Security & Risk

Control before execution.

Policy expressed once, enforced everywhere agents act — with complete evidence.

Operations & Product

More workflows, live.

Approval friction goes down as trust goes up — because every action is governable.

Executives

A defensible answer.

AI adoption with consistent governance, auditable proof, governed autonomy.

Current stage — Functional prototype

We claim the model and the architecture as designed — not certifications, production deployments, or adoption the record does not support.

Governance Architecture

The model first.
Then the machine.

The architecture expresses the governance model. The implementation evolves as the product matures.

One architecture operationalizes the model: one governance layer, one policy engine, one decision engine, one evidence system, one trust model.

The architecture

Model → layer →
engines → implementation.

The governance model is the invariant every component serves. The layer is the single control point every action passes through. The engines decide and record. Implementation components sit underneath — they implement the architecture; they don't define the company.

InvariantGovernance Model
LayerGovernance Layer
EnginePolicy Engine
EngineDecision Engine
Governance objectManaged Policy-Aware Agent Event
SystemEvidence System
SystemGovernance Intelligence
ModelTrust Model
UnderneathImplementation components

Every evaluated action is normalized into one Managed Policy-Aware Agent Event — the canonical governance object that powers evidence, intelligence, analytics, reporting, and continuous policy improvement.

Understand MPAE

The operating system

One loop, end to end.

AI Agent Action
One Governance Layer
One Policy Engine
One Decision Engine
PASS / VERIFY / BLOCK
Managed Policy-Aware Agent Event
One Evidence System
Governance Intelligence
One Trust Model

The model proposes. Xelyria evaluates and decides. Airlockctl gates. APILock records proof.

One product

One product. One engine.
Five capabilities.

Kistora is one product. Its capabilities are modules of that single product — one governance model, one visual identity, one engine.

Local protection

Before anything leaves.

Local protection before sensitive information or risky actions leave the environment — LeakGuard.

Policy & decision

Evaluate the action.

The policy and decision engine evaluating agent actions — Xelyria.

Enforcement

Deterministic gates.

Deterministic enforcement — PASS, VERIFY or BLOCK — Airlockctl.

Evidence

Verifiable records.

The evidence layer creating verifiable action records — APILock.

Intelligence

Learn, privacy-safe.

Privacy-safe intelligence from governed agent activity — Data Intelligence.

Module names are working names, subordinate to the governance model — capabilities of one product, never separate products.

Exploded architecture stack: the governance model as a teal plane above dark glass layers, with the MPAE object between them
The principle

Decide once.
Enforce everywhere.

Kistora separates the governance decision from its enforcement. The decision is made centrally by one model; enforcement happens at the boundary of each environment. The agent proposes, the decision engine decides, the gate enforces, and the evidence system records proof.

Kistora Console — Decision Feed

INTERFACE CONCEPT · DECISION FEED

14:02:11payments.refund · €180.00PASS
14:01:47data.export · 4,000 recordsVERIFY
14:01:32access.grant · production/adminBLOCK
14:00:58orders.create · supplier #S-114PASS
14:00:12deploy.config · stagingPASS

EVIDENCE — act_c41b08

type : data.export policy : data-movement-v2 decision : VERIFY held_for : data-owner executed : pending record : sealed

Interface concept in the identity system — to be replaced by a real capture of the functional prototype.

For technical readers

Built to be evaluated.

Implementation layers

The architecture is implemented through dedicated components for policy evaluation, decision execution, action gating, and evidence capture. Component naming is subordinate to the governance model. Detailed documentation is provided during technical evaluation.

Trust boundaries & data minimization

The governance layer operates on action metadata and policy context. It records what decision-making and proof require — and no more. Sensitive payloads remain within your environment; evidence references actions and decisions, not raw data.

Integration surfaces

Designed for integration where agents already act: API boundaries, tool-execution layers, and agent frameworks. SDK and API documentation will be published as the platform matures toward general availability.

Claim discipline

Current stage: functional prototype. We separate current capabilities, committed roadmap, and future concepts — and will not claim certifications, production deployments, or adoption that the record does not support.

Managed Policy-Aware Agent Events

MPAE. The unit
of governance.

Every governed AI action becomes one Managed Policy-Aware Agent Event (MPAE): the canonical governance object that carries evidence, intelligence, analytics, reporting, and continuous policy improvement.

The MPAE: a precise hexagonal object with a sealed mark at its center
Why MPAE exists

Governance needs a unit.

Logs describe what happened. Risk scores describe how dangerous it looked. Neither is a governance object. Without a common unit, every agent action is recorded differently, proven differently, and learned from inconsistently — which is exactly how fragmentation wins.

The MPAE closes that gap: one governance object representing the evaluated action, governance decision, and associated evidence model.

The canonical hierarchy

Action. Decision. MPAE.
Then everything downstream.

AI Action — what the agent proposes to do. Not yet governed.
Governance Decision — PASS / VERIFY / BLOCK, the outcome of deterministic evaluation.
Managed Policy-Aware Agent Event — the normalized governance representation of the evaluated action. Not the raw action. Not the risk score.

MPAE is not a processing step after decision; it is the canonical governance record created from the decision that enables evidence, intelligence, analytics, reporting, and policy improvement.

Downstream systems — evidence, governance intelligence, analytics, reporting, and policy learning all consume MPAEs.
The operating system

Where the MPAE is born.

Scroll to walk the loop — or select any step.

MPAE structure

What one event contains.

Field groupContents
Governance contextUser, agent, model, environment, tool, action
Policy evaluationPolicies applied, conditions assessed, policy version
Risk classificationMPAE Classification (domain) · MPAE Level (L0–L5) · Risk Score
Governance decisionPASS / VERIFY / BLOCK
Evidence metadataSealed receipt — metadata only; no raw prompts, no secrets, no payloads by default
Execution outcomeExecuted, held, or stopped — with timestamp
Intelligence metadataAggregation fields for analytics, reporting, and policy learning
MPAE levels

L0 to L5.
Risk, made legible.

LevelClassTypical posture
L0InformationalSafe public reads — PASS, no gate, baseline recorded
L1RecordLow-impact internal work — PASS with full record
L2ElevatedScoped internal access — PASS within policy bounds
L3SensitiveSensitive data or access — PASS or VERIFY by context
L4CriticalProduction-affecting or irreversible — VERIFY by default
L5CatastrophicOutside delegated authority — BLOCK, always evidenced

Levels classify governance severity; the numeric Risk Score is an implementation attribute used for thresholds, analytics, and optimization.

MPAE in incident analyses

Incidents, normalized.

Public reporting describes agent-driven deletions of production databases. Expressed as an MPAE, that moment looks like this:

Incident — expressed as MPAE
proposed_action : database.delete · production classification : Infrastructure mpae_level : L5 · Catastrophic risk_score : 0.99 decision : BLOCK verification : required · irreversible operation evidence : generated · sealed intelligence : pattern feeds future policy

Illustrative normalization of a publicly reported incident pattern — not a claim that any specific incident would have been prevented.

Read incident analyses

MPAE in governance journeys

Every journey ends
in an MPAE.

Mid-Market & Enterprise · UC09

An agent proposes disabling executive login protection.

Evaluation. Identity domain · L5 Catastrophic · outside delegated authority in all contexts.

Decision. BLOCK — the attempt itself becomes a sealed, attributable MPAE.

One event: governed, evidenced, and feeding future protection.

See all fifteen journeys

The category moat

The unit is the moat.

Every governed AI action becomes a traceable event that organizations can analyze, audit, and improve over time. Because every action is normalized into the same governance object, Kistora can govern, measure, compare, and improve AI actions consistently — across every model, agent, action, and environment. Whoever defines the unit of governance defines the category.

"Every governed AI action becomes one Managed Policy-Aware Agent Event — and every MPAE makes the next decision better."

Governance Journeys

Different situations.
Same governance model.

Journeys — representative situations across L0–L5. From safe public reads to catastrophic-risk attempts, every one ends the same way: in an MPAE.1

Fifteen different paths crossing the same single governance checkpoint and continuing in order
Developers · UC01

An agent checks public software risk.

A developer asks an AI coding assistant whether a public package is safe to use.

L0 · InformationalPASS

Full journey
ActorDeveloper
ActionAsk an agent to review a public software library.
SystemPublic package registry and vulnerability feeds.
StakeFast guidance without touching private systems.

Without governance. Safe read-only work is treated the same as risky work. Teams add friction where none is needed and lose the baseline that helps them detect escalation later. The action becomes hard to prove after execution.

Why it matters. The more useful agents become, the more important clean risk separation becomes. Kistora lets safe public reads stay fast while preserving a governed baseline for future decisions.

ProtectLeakGuardChecks that no secrets, internal paths, or private repository references enter the query.
ProposeAI agent / LLM interfaceDeclares a public package risk lookup against public data sources.
EvaluateXelyriaEvaluates public source type, read-only scope, data sensitivity, and system access.
DecideXelyria + AirlockctlPASS. Safe public read proceeds without a gate.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates safe-read patterns so future internal or sensitive access stands out.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Developers · UC02

An agent reads private code.

A developer asks an AI agent to review a private repository branch.

L2 · ElevatedPASS

Full journey
ActorSenior developer
ActionAsk an agent to analyze private repository code.
SystemPrivate Git branch with schema and business logic.
StakeUseful code assistance without uncontrolled access.

Without governance. The agent reads sensitive code, but the team lacks a clean record of scope, policy, and purpose. The work is useful, yet the proof trail is weak. The action becomes hard to prove after execution.

Why it matters. Real developer value comes from agents working on real code. Kistora makes sensitive reads governable without blocking the work.

ProtectLeakGuardRemoves secrets, tokens, credentials, and unnecessary internal paths before analysis begins.
ProposeAI agent / LLM interfaceDeclares a private repository read for migration analysis.
EvaluateXelyriaEvaluates repository sensitivity, branch scope, read-only status, and exposure risk.
DecideXelyria + AirlockctlPASS. Scoped read proceeds under policy and receipt requirements.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates sensitive-code access patterns and identifies repositories needing stricter policy.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Developers · UC03

An agent pushes code toward production.

An AI coding agent prepares a hotfix inside the IDE.

L4 · CriticalVERIFY

Full journey
ActorDeveloper
ActionLet an agent push a hotfix directly.
SystemMain branch behind a production-adjacent repository.
StakeSpeed without uncontrolled production change.

Without governance. The action reaches the highest-risk branch path before a human decision. Review is skipped and accountability becomes harder to prove. The action becomes hard to prove after execution.

Why it matters. The more agents accelerate development, the more production-adjacent actions need clear control. Kistora keeps the speed while forcing the right decision point.

ProtectLeakGuardChecks commit context, secrets, tokens, credentials, and exposed internal paths before action flow.
ProposeAI agent / LLM interfaceDeclares a direct push to the main branch of a production-adjacent repository.
EvaluateXelyriaEvaluates branch target, environment, write scope, deploy path, and rollback exposure.
DecideXelyria + AirlockctlVERIFY. Airlockctl enforces a human gate before execution.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates branch, approval, and production-adjacent write patterns for safer policy defaults.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Startups & SMBs · UC04

An agent drafts release notes.

A CTO asks an internal AI assistant to draft release notes from merged work and closed tickets.

L1 · RecordPASS

Full journey
ActorStartup CTO
ActionAsk an agent to summarize the sprint.
SystemIssue tracker, Git metadata, and internal wiki.
StakeRoutine automation with a clear record.

Without governance. Routine AI-generated work appears without a consistent event trail. The team saves time but loses visibility into repeated agent workflows. The action becomes hard to prove after execution.

Why it matters. Startups need agent workflows that feel lightweight. Kistora records routine actions without slowing them down, building repeatable governance from day one.

ProtectLeakGuardChecks the draft for secrets, tokens, credentials, and unintended sensitive content.
ProposeAI agent / LLM interfaceDeclares creation of a draft changelog in the internal knowledge base.
EvaluateXelyriaEvaluates source data, destination, reversibility, and business impact.
DecideXelyria + AirlockctlPASS. The draft is created and recorded.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates documentation patterns to show how low-risk AI work spreads across teams.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Startups & SMBs · UC05

An agent exports customer usage data.

A product leader asks for a 30-day usage snapshot.

L2 · ElevatedPASS

Full journey
ActorHead of Product
ActionAsk an agent for an account-level usage snapshot.
SystemAnalytics warehouse and internal planning workspace.
StakeBetter planning without uncontrolled data movement.

Without governance. The export moves through planning workflows without a clear proof of scope, destination, or policy. Useful data becomes harder to govern later. The action becomes hard to prove after execution.

Why it matters. Useful agents need access to real operating data. Kistora makes the export governable by proving what moved, where it went, and under which policy.

ProtectLeakGuardChecks for direct PII, contact data, and unnecessary identifiers before export.
ProposeAI agent / LLM interfaceDeclares an internal usage-data export for planning.
EvaluateXelyriaEvaluates data sensitivity, account identifiers, date range, destination, and internal-use scope.
DecideXelyria + AirlockctlPASS. Export proceeds only to an approved internal destination.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates export frequency, destination patterns, and scope expansion signals.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Startups & SMBs · UC06

An agent sends customer discounts.

A founder asks an AI assistant to identify churn risk.

L4 · CriticalVERIFY

Full journey
ActorFounder
ActionAsk an agent to act on churn risk.
SystemCRM and email marketing platform.
StakeCustomer-facing financial action.

Without governance. The campaign can reach the market before a founder reviews price impact, contract conflicts, and brand risk. Once sent, the action cannot be pulled back. The action becomes hard to prove after execution.

Why it matters. Agents can surface strong recommendations. Kistora keeps customer-facing financial actions under explicit human control.

ProtectLeakGuardChecks the campaign draft for secrets, unintended PII, and sensitive content.
ProposeAI agent / LLM interfaceDeclares a discount campaign to paying accounts.
EvaluateXelyriaEvaluates external audience, send volume, price change, revenue impact, and contract conflict risk.
DecideXelyria + AirlockctlVERIFY. Founder review is required before the campaign can run.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates high-stakes outbound-action patterns for pricing, communication, and approval policy.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Enterprise · UC07

An agent reads public security guides.

A security analyst asks an internal AI assistant to find public templates for AI agent policy.

L0 · InformationalPASS

Full journey
ActorSecurity analyst
ActionAsk an agent to collect public guidance.
SystemPublic web sources and vendor documentation.
StakeUseful research with no internal exposure.

Without governance. Harmless research gets slowed by heavy controls. Teams either wait too long or route around governance for simple work. The action becomes hard to prove after execution.

Why it matters. Enterprise governance must be precise, not heavy by default. Kistora keeps public research fast while preserving the baseline for higher-risk actions.

ProtectLeakGuardChecks that no internal data, identifiers, or draft policy text are attached to the public query.
ProposeAI agent / LLM interfaceDeclares a public security-policy research task.
EvaluateXelyriaEvaluates public source type, read-only scope, and lack of sensitive data.
DecideXelyria + AirlockctlPASS. Public research proceeds without a gate.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates public-research patterns to identify future queries that drift into private content.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Enterprise · UC08

An agent updates access rules.

An IAM engineer asks an agent to turn audit findings into access-rule updates.

L3 · SensitivePASS

Full journey
ActorIAM engineer
ActionAsk an agent to translate audit findings into policy updates.
SystemInfrastructure-as-code repository and staging environment.
StakeAccess logic with downstream production impact.

Without governance. Access-policy changes move toward production without a clear governance path. The organization loses proof of scope, decision, and accountability. The action becomes hard to prove after execution.

Why it matters. The more useful agents become in infrastructure work, the more critical policy governance becomes. Kistora allows assistance while keeping access changes controlled.

ProtectLeakGuardVerifies that secrets, keys, credentials, and sensitive diffs are not exposed.
ProposeAI agent / LLM interfaceDeclares an IAM policy update in staging and a pull request for review.
EvaluateXelyriaEvaluates staging scope, access-control impact, environment, and downstream production risk.
DecideXelyria + AirlockctlPASS. Pull request creation proceeds under policy; auto-merge remains blocked.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates access-rule changes and highlights drift risk across proposed agent updates.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Enterprise · UC09

An agent disables executive login protection.

An urgent ticket asks the helpdesk to unblock an executive login.

L5 · CatastrophicBLOCK

Full journey
ActorHelpdesk operator
ActionAsk an agent to resolve an urgent login issue.
SystemSSO and executive account controls.
StakePrivileged account protection.

Without governance. A helpful agent follows urgency instead of verified authority. A privileged account loses critical protection at the worst possible time. The action becomes hard to prove after execution.

Why it matters. Support agents must move fast without bypassing critical controls. Kistora blocks catastrophic shortcuts and routes the operator to the proper escalation path.

ProtectLeakGuardFlags that the request is not coming through a verified privileged-access workflow.
ProposeAI agent / LLM interfaceDeclares removal of login protection on a VP-level account.
EvaluateXelyriaEvaluates privileged status, security-control removal, urgency pattern, and social-engineering signals.
DecideXelyria + AirlockctlBLOCK. No approval path exists under default policy.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates privileged-account and urgent-access patterns for stronger policy calibration.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Platform Teams · UC10

An agent registers an internal tool.

A platform engineer asks an agent to register a new read-only metrics API.

L1 · RecordPASS

Full journey
ActorPlatform engineer
ActionAsk an agent to register a new internal tool.
SystemAgent tool registry and read-only metrics API.
StakeAgent ecosystem growth with a record.

Without governance. The tool registry grows without a reliable history. Platform teams lose visibility into how agents gained new capabilities. The action becomes hard to prove after execution.

Why it matters. Internal AI platforms need governance that scales with tool growth. Kistora records each new capability as the ecosystem expands.

ProtectLeakGuardConfirms no secrets, credentials, tokens, or connection strings are present.
ProposeAI agent / LLM interfaceDeclares registration of a read-only metrics API in the agent tool registry.
EvaluateXelyriaEvaluates tool type, read-only status, reversibility, and administration scope.
DecideXelyria + AirlockctlPASS. Registration proceeds as a recorded configuration update.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates tool-registration patterns and flags write-capable tools for higher governance.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Platform Teams · UC11

An agent changes API limits.

An SRE asks an agent to investigate downstream errors.

L2 · ElevatedPASS

Full journey
ActorPlatform SRE
ActionAsk an agent to reduce throttling errors.
SystemShared internal API and staging configuration.
StakeOperational change with rollback requirements.

Without governance. Configuration experiments blend into operations without clear proof of reason, scope, or rollback. Teams lose the line between suggestion and change. The action becomes hard to prove after execution.

Why it matters. Platform teams need to test agent-suggested improvements without losing discipline. Kistora keeps staging changes fast and provable.

ProtectLeakGuardScans the configuration diff for secrets, tokens, credentials, and sensitive values.
ProposeAI agent / LLM interfaceDeclares a staging rate-limit update for a shared service.
EvaluateXelyriaEvaluates staging scope, reversibility, downstream impact, and production exposure.
DecideXelyria + AirlockctlPASS. Staging change proceeds with receipt and rollback conditions.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates configuration-change patterns and flags production escalation signals.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Platform Teams · UC12

An agent disables payment audit logs.

A platform owner reviews an AI-generated storage cost proposal.

L4 · CriticalVERIFY

Full journey
ActorPlatform owner
ActionReview an AI cost-reduction proposal.
SystemPayments service and tenant audit logging.
StakeAudit trail, compliance, and forensic proof.

Without governance. Cost optimization overrides the audit trail. Incident response, compliance evidence, and contractual proof become weaker. The action becomes hard to prove after execution.

Why it matters. Agents can improve infrastructure cost, but financial-system proof cannot be traded away quietly. Kistora forces review when optimization touches critical controls.

ProtectLeakGuardFlags the proposal as a compliance-impacting change tied to payments logging.
ProposeAI agent / LLM interfaceDeclares disabling audit logging for a tenant group on a payments service.
EvaluateXelyriaEvaluates payments scope, log removal, compliance impact, tenant impact, and forensic risk.
DecideXelyria + AirlockctlVERIFY. Multi-stakeholder approval is required before any change proceeds.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates cost-driven proposals that target controls and improves future policy quality.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Partners · UC13

An agent finds governed tools.

A partner developer plans an integration.

L0 · InformationalPASS

Full journey
ActorPartner developer
ActionAsk an agent to explore available governed tools.
SystemPublic tool catalog.
StakeLow-friction ecosystem discovery.

Without governance. Partners struggle to understand what governed agent actions can do. The ecosystem feels harder to adopt than it needs to be. The action becomes hard to prove after execution.

Why it matters. Ecosystem adoption starts with simple discovery. Kistora keeps exploration lightweight while setting the stage for governed cross-environment access.

ProtectLeakGuardEnsures no tenant secrets, private identifiers, or internal integration details enter the query.
ProposeAI agent / LLM interfaceDeclares a public catalog lookup for Kistora-compatible tools.
EvaluateXelyriaEvaluates public metadata scope, read-only status, and lack of tenant access.
DecideXelyria + AirlockctlPASS. Catalog discovery proceeds without a gate.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates discovery patterns to inform ecosystem planning and partner education.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Partners · UC14

A partner agent reads customer data.

A partner platform agent prepares an internal satisfaction report for one tenant.

L3 · SensitivePASS

Full journey
ActorPartner platform agent
ActionGenerate a tenant satisfaction report.
SystemShared customer data API.
StakeTenant isolation and governed cross-environment access.

Without governance. Cross-tenant data access depends on fragile configuration and trust. A single misrouted request can cross the wrong boundary. The action becomes hard to prove after execution.

Why it matters. Partner platforms need agents that operate across systems without weakening tenant isolation. Kistora makes each cross-environment action traceable and enforceable.

ProtectLeakGuardChecks that raw secrets and unnecessary PII are not included beyond contracted fields.
ProposeAI agent / LLM interfaceDeclares a read of aggregated satisfaction data for one tenant through a shared API.
EvaluateXelyriaEvaluates tenant scope, data sensitivity, shared API access, entitlement status, and rate limits.
DecideXelyria + AirlockctlPASS. The call proceeds only when tenant-specific policy checks pass.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates cross-tenant access events and improves entitlement-policy recommendations.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

Partners · UC15

A third-party agent exports tenant data.

A third-party agent begins preparing a bulk export.

L5 · CatastrophicBLOCK

Full journey
ActorThird-party marketplace agent
ActionPrepare a bulk export across tenants.
SystemMulti-tenant data environment and external cloud bucket.
StakeCross-tenant data protection.

Without governance. One misconfigured agent turns marketplace access into cross-tenant data loss. Detection after execution is too late. The action becomes hard to prove after execution.

Why it matters. Ecosystem scale requires hard boundaries. Kistora blocks catastrophic patterns before execution and records what was attempted.

ProtectLeakGuardDetects sensitive data markers, PII patterns, and multi-tenant identifiers before execution.
ProposeAI agent / LLM interfaceDeclares a raw data export across tenants to an external storage bucket.
EvaluateXelyriaEvaluates cross-tenant scope, raw-data volume, external destination, policy path, and ecosystem impact.
DecideXelyria + AirlockctlBLOCK. No approval path exists under standard policy.
ProveAPILock / Safe ReferencesMetadata-only receipt. The reference travels, never the key. No raw prompts. No secrets. No payloads by default.
LearnData Intelligence / MPAEAggregates critical-anomaly patterns for stronger marketplace and cross-tenant risk calibration.

MPAE learning. Managed Policy-Aware Agent Events aggregate into governance, audit, intelligence, policy improvement, and risk calibration. No raw prompts. No secrets. No payloads by default.

One MPAE — governed, evidenced, learning.

1 Representative usage scenarios — functional-prototype stage, pre-commercial; no customer relationship implied. Decision wording follows KDCOS-00B (PASS / VERIFY / BLOCK); each journey follows the governance lifecycle: Protect → Propose → Evaluate → Decide → Prove → Learn.

Company

We believe autonomy
should be governed.

Kistora is defining Agent Access Control — the category, the model, and the infrastructure that lets organizations trust what AI agents do.

Why we exist

“We founded Kistora because autonomous AI cannot scale without consistent governance.”

Mission

Enable trusted AI adoption through consistent governance of agent actions.

Principles

How we build.

01

Governance enables.

Consistent control is what allows autonomy to scale — not what slows it down.

02

Truth before claims.

We state our maturity accurately and attach evidence to what we assert.

03

Calm authority.

No fear, no hype. Precise language, coherent architecture, proof.

04

One model.

Consistency is the product, the promise, and the moat.

05

Evidence by design.

Auditability is not bolted on — it is how the system thinks.

06

Category stewardship.

A contributor and reference point in the emerging Agent Access Control category — terminology, frameworks, reference practices.

Early · Deliberate · Functional prototype

Governance Library

Knowledge that
works harder.

Foundations, incident analyses, governance patterns, reference notes, and playbooks — every page owns one question.

Foundations

Pillar

How decisions are made

The loop, the spectrum, the decision moment.

Read

Pillar

What is an MPAE?

The canonical governance object, explained.

Read

Broken glass shards reforming into a clean row of identical sealed hexagonal tiles

Incident Analyses

Based on public reporting and primary disclosures; qualifiers reflect source certainty. We do not claim any specific incident would have been prevented.

Infrastructure

Production database deleted by an agent.

Founder accounts and reporting describe an agent-driven deletion of a production database and backups within seconds, via infrastructure tooling.

L5 · CatastrophicBLOCK

Pattern: destructive action with no independent governance layer before execution.

Infrastructure

Live database deleted during a code freeze.

An AI coding tool publicly described as making a "catastrophic error in judgment" deleted a live production database during a change freeze.

L5 · CatastrophicBLOCK

Pattern: no verification requirement for irreversible operations.

Data

Autonomous agent escapes an evaluation boundary.

Coverage describes a malicious dataset exploiting code-execution paths, with an agent reportedly accessing infrastructure beyond its boundary. Numerical claims track primary disclosures.

L4 · CriticalVERIFY

Pattern: excessive credentials with broad scope and long lifetimes.

Identity

Rogue internal agent exposes sensitive data.

Reporting indicates a rogue internal agent contributed to a Sev-1 incident by exposing internal data beyond its intended scope.

L4 · CriticalVERIFY

Pattern: agents acting with write authority and no deterministic pre-action evaluation.

Operations

Enterprise assistants abused via crafted prompts.

Research describes enterprise assistants manipulated through crafted prompts and integrations to exfiltrate data — including "0-click" compromises.

L3 · SensitiveVERIFY

Pattern: fragmented controls each seeing pieces; none governing the action.

Governance Patterns

Pattern

Independent layer before execution

A governance decision point that no agent, tool, or workflow can bypass.

Pattern

Verification for the irreversible

Destructive and high-impact operations are held for verification by default.

Pattern

Deterministic evaluation

Decisions driven by explicit policy evaluation — not ad-hoc rules or subjective judgment.

Reference Notes & Playbooks

Upcoming

Reference Notes

Canonical definitions, glossary, and standards vocabulary.

Upcoming

Playbooks

Operational guides for governing agent workflows, domain by domain.

Every resource owns one question and one search intent. Resources expand depth, not direction.

Contact

Start the
conversation.

Evaluating the technology, exploring partnership, or discussing the category — tell us where you sit, and we'll bring the right depth.

Founders

Talk to us directly.

The category, the governance model, and where Kistora is heading.

Write to the founders

Technical

Go deeper.

Request the technical overview, or arrange a working session with the prototype.

Request materials

Partners

Build with us.

Ecosystem-agnostic by design. If governed execution complements what you build, let's explore it.

Express interest

Investor / category discussion

Discuss the category.

Request an investor overview of Agent Access Control, governance architecture, and roadmap.

Discuss the category

Prototype interface — the production site will connect these paths to a governed intake workflow.