What is Kastra?

Kastra is a runtime authorization layer built specifically for AI agents. It sits directly in the path of every action an AI takes—prompts, tool calls, shell commands, and API requests—and decides whether to allow or deny each one before it executes. With sub-millisecond latency (p99 of 0.8ms), Kastra enforces policies across tools, inputs, and outputs, acting as a policy decision point that prevents unauthorized tool use, prompt injection, and sensitive data exposure before they become incidents.

Who it's for

• Engineering teams building or deploying AI agents that need to enforce granular, pre-execution policies across multiple agent frameworks and SDKs.
• Security and compliance officers who require auditable, signed, and append-only decision logs to satisfy SOC 2, ISO 27001, HIPAA, or GDPR requirements.
• Platform and infrastructure engineers managing AI workloads at scale who need a single control plane to govern agents and policies across Claude Code, Cursor, Codex, OpenClaw, Anthropic SDK, OpenAI SDK, and more.

Key features

Pre-execution policy enforcement

Kastra evaluates every AI action against your policies before the action reaches its target. It runs four ordered checks—identity, scope, guardrails, and audit—and returns an allow or deny verdict in under a millisecond. Only permitted actions proceed; everything else is blocked and logged.

Kastra Recon

This feature scans your coding agent's history—even before you start enforcing policies—and surfaces risky actions it already performed, such as reading secrets, destructive shell commands, or prod database access. Recon then drafts a self-verified policy for each risk, letting you audit first and enforce next.

Unified control plane

Kastra provides one control plane for every AI action across your organization. It includes nine modules that form a single loop: decide, enforce, prove. One policy language, one audit vault, and sub-millisecond decisions. Deployment options include cloud, self-hosted, and air-gap.

Signed, append-only audit trail

Every decision is signed with ed25519 and stored in an append-only vault. The audit stream can be forwarded to SIEM, Datadog, Splunk, or S3, giving teams a replayable, tamper-evident record of every AI action and its verdict.

What stands out

Kastra decides what your AI is allowed to do — before it does it.

This is the fundamental difference between Kastra and every monitoring or observability tool on the market. Most solutions watch AI after it acts, logging incidents that have already happened. Kastra sits in the critical path and blocks unauthorized actions in real time, making it a new category of infrastructure rather than a feature bolted onto an existing product. It's not chatbot moderation, post-hoc logging, or generic content filtering—it's a runtime authorization layer purpose-built for AI agents.

Worth checking out if…

You're deploying AI agents in production and need to enforce security policies with sub-millisecond latency, or you're responsible for compliance in regulated environments where every AI action must be auditable and provably controlled. Kastra is also worth evaluating if you manage multiple agent frameworks and want a single control plane to govern policies across all of them, or if you need to audit what your coding agents have already done before rolling out enforcement.