The Agent Access Control category

Every agent action is decided before it runs.

Kistora is the governed decision layer between AI agents and the systems they want to reach. It intercepts each action before execution, rules pass, block, or hold for a human, and leaves a tamper-evident receipt. Without slowing the work down.

Pre-release. No spam, just an early invite.
Intercepted · pre-execution AGENT KISTORA SYSTEM
agent.fs.read("/etc/app/config.yaml")
  • policy.scope · evaluating
  • policy.destination · evaluating
PASS
decision pass
before execution
Tamper-evident receiptEd25519
receipt_idrcpt_8f3c2a
decisionpass
action_hash0x4d7a…91
policy_hash0x9a4e…2b
prev0x71c4…e0
secret·· never held · ref kistora://cred/…
Send a test action
Decision ledgermetadata only · tamper-evident
The missing layer

Agents have moved from answers to actions.

They touch code, tools, workflows, credentials, and production systems. The question is no longer what an agent can generate. It is what it is allowed to do before it touches a real system, and who decides. Kistora is that decision point, and the proof afterward.

One solution · its modules

Kistora is a single platform. Each module does one job, and hands to the next.

01 · BOUNDARY
LeakGuard
Keeps secrets from ever reaching the AI.
02 · USE
Safe Reference
Uses a secret without holding the key.
03 · VERIFY
Airlock
A deterministic gate that checks claims against evidence.
04 · BRAIN
Xelyria
The control room that runs the workflow.
05 · GOVERN
APILock
Policy, identity, revocation, tamper-evident receipts.
06 · VAULT
Cloud Vault
Stores ciphertext we cannot decrypt.
Hold the proof, not the secret

Trust comes from proof, not promises.

Every governed decision is committed to a tamper-evident, hash-chained ledger: a signed, metadata-only receipt that proves what was decided, and why. The reference travels, never the key.

Metadata onlyHash-chainedEd25519 signedProvable non-custodyVendor-neutral
ReceiptEd25519
receipt_idrcpt_8f3c2a
decisionhuman_required
action_hash0x4d7a…91
policy_hash0x9a4e…2b
prev0x71c4…e0
secret·· never held · ref kistora://cred/abc
Agent Access Control · governed before execution

Stop trusting. Start verifying. Hold the proof, not the secret.

// you are on the list. we will be in touch.