Kastra

Kastra is a runtime authorization layer for AI systems, built by Kastra Labs Inc. and headquartered in Newark, Delaware. It sits in the execution path of every AI action — shell commands, database queries, API requests, browser clicks, and tool calls — and issues an allow or deny verdict before the action runs, with a stated p99 latency under one millisecond. The platform is designed for teams deploying autonomous AI agents in regulated or production-critical environments who need to answer, in seconds, what each agent is allowed to do, which rule permitted a given action, and whether access can be revoked without redeployment.

What It Is

Kastra positions itself as the authorization layer for AI — a policy decision point (PDP) that intercepts AI-generated actions before they reach real systems. Unlike observability or monitoring tools that record what happened after the fact, Kastra evaluates each action against a versioned policy and returns a signed verdict in real time. The platform organizes its capabilities into three loops: Decide (runtime authorization and policy engine), Enforce (Kastra Edge for developer laptops, autonomous agent controls, OpenClaw browser agent integration, and endpoint governance), and Prove (signed append-only audit trail and flexible deployment architecture). Every decision is cryptographically signed with ed25519 and stored in an append-only audit vault that can be streamed to a SIEM, Datadog, Splunk, or S3.

Core Architecture and Modules

The platform ships nine modules across the three loops:

• Runtime Authorization — the central PDP that checks every action against policy before execution.
• Policy Engine — a typed, versioned domain-specific language for writing what AI can and cannot do, managed like code.
• Post-Inference Validation — inspects model output before it touches a downstream system.
• Kastra Edge — a local daemon (available as a macOS app or CLI via Homebrew) that governs coding agents such as Claude Code, Cursor, and Codex CLI on developer laptops.
• Autonomous Agent Controls — scopes each step of multi-step workflows and gates sensitive steps behind human approval.
• OpenClaw Integration — intercepts every click, form fill, navigation, and download from autonomous browser agents before the DOM event fires.
• Endpoint Governance — controls AI tools across employee laptops, build agents, and engineering workstations.
• Audit Trail — signed, append-only traces with configurable retention and export to external systems.
• Deployment Control — supports cloud, hybrid, self-hosted, and air-gapped topologies with identical policy semantics across all.

Kastra Recon and Shadow Mode

Kastra Recon is a scan-first feature that lets teams audit their coding agent's existing history before enabling enforcement. It surfaces risky actions already taken — secret writes, force pushes, production database reads, piped shell downloads — and auto-drafts a self-verified policy for each finding. This supports a "shadow mode" rollout path: deploy Kastra without blocking anything, observe real AI runtime activity, validate policy fit against live traffic, then graduate to enforcement mode that blocks denied actions in real time and sends alerts to Slack or webhooks.

Compliance and Deployment Posture

The platform targets regulated industries including finance, healthcare, government, defense, legal, and retail. According to the Kastra website, the platform is SOC 2 Type II (in audit), ISO 27001 (Stage 2, targeting 2026), HIPAA (BAA available), GDPR (EU residency supported), EU AI Act (Article 9 mapped), and FedRAMP Moderate (in preparation). The enterprise tier adds single-tenant VPC deployment, customer-managed KMS keys, RBAC with SSO/SAML and SCIM provisioning, break-glass with dual approval, and a named technical account manager with a stated 15-minute incident response SLA. Air-gapped and on-premises deployments are supported for sovereign cloud and defense use cases.

SDK and Integration Surface

Kastra publishes SDKs for TypeScript, Python, Go, Rust, Java, and Swift, along with an OpenAI-compatible proxy for drop-in integration with any OpenAI-spec runtime. The platform natively supports Claude Code, Codex CLI, Cursor, OpenClaw browser agents, and custom in-house agent systems. An MCP integration and CLI are also documented. Control plane regions include us-east-1, eu-west-1, and ap-south-1.

Who It Is Built For

The platform targets a range of audiences from solo developers (free local enforcement with no account required) to platform teams running thousands of agents and enterprise security teams in regulated industries. The company describes itself as built by engineers, security researchers, and policy practitioners who believe execution governance is a precondition for autonomous AI deployment rather than an afterthought.