Run agents in production. Not in fear.
Before your agent touches money, data or production, one in-process Kernel decides what runs, verifies the intent behind it, and encrypts the data the agent shouldn't see.
Human-over-the-loop.
A human approving every agent action isn't oversight. It's a bottleneck.
Kernel runs the agent autonomously on everything reversible and routes only the irreversible actions to a person, by policy, before they execute. Every one of those decisions is signed
14:22:08 payment-agent-prod → Kernel.check() action: initiate_payment · £34,800 GBP payee: Meridian Holdings Ltd · NEW beneficiary signals: amount > £5k · not on allow-list verdict: REQUIRE_HUMAN
14:26:41 ana.ruiz (Finance) → BLOCKED beneficiary unverified · flagged to onboarding logged: agent · amount · payee · decision · Art 14
What happens before your agent acts.
One SDK call wraps every consequential agent action. Before it runs, three checks fire that you can't turn off, identical on every Kernel install, signed for every audit.
verdict = await Kernel.check(action) if verdict.allow: run(action) elif verdict.require_human: route_to_human(action) else: block(action)
One call. Three verdicts. Any framework.
Agents can be manipulated. Kernel can't.
Kernel covers the full OWASP Agentic Top 10 by default, runs before any policy check, cannot be configured away, and anchors agent intent at creation so mid-session manipulation is caught before execution.
Prompt Injection
A support ticket contains invisible text instructing your refund agent to transfer funds to an external account.
Every action checked against declared intent.
When agents spawn sub-agents or run multi-step plans, intent drift is the failure mode that catches teams by surprise. Kernel anchors agent intent at creation. Mismatch is caught before execution.
When the agent is created, it declares its purpose and the actions allowed within that purpose. Kernel stores this intent immutably for the agent's lifetime.
Before every action, Kernel checks the action against the agent's declared intent. Matches proceed. Mismatches are stopped at the intent layer, regardless of what the agent thinks it should do.
Every intent mismatch is logged with the action attempted, the declared intent, and a possible-compromise flag. This is your earliest signal that an agent is being manipulated.
Agents can't leak what they never saw.
Kernel sits between your data and the agent's context. The agent still does the job. The data stays under cryptographic control end-to-end. Each sensitive field is protected at the level you choose:
Credentials never leave your infrastructure. Data never leaves your process. Private keys never leave your KMS.
How Kernel decides each level
One policy.yaml maps every field to a protection level. Sealed fields travel as opaque handles the agent can transport but never read. The classifier runs on every call, no field ships unlabeled.
How sealing actually works
Your KMS holds the root key. Kernel derives a per-record DEK (AES-256-GCM), wraps it under your KMS master key (RSA-OAEP), and signs each operation with Ed25519. The agent carries only ciphertext, a blind courier that never holds plaintext.
What lands in your audit log
Every decision, encryption and unwrap, Ed25519-signed, hash-chained, tamper-evident. Exportable in EU AI Act and DORA formats. A regulator can verify what the agent saw and what it never touched, field by field, and prove nothing was altered after the fact.
In April 2026, Microsoft published the Agent Governance Toolkit under the MIT License, the clearest signal that runtime governance for AI agents is a real category. Kernel is the regulated-enterprise implementation above that floor: REQUIRE_HUMAN as a first-class verdict, intent anchoring before execution, vertical policy packs validated for fintech, and an audit log exportable on demand.
Read the full comparison →"Safety decisions must be deterministic, not prompt-based."— Imran Siddique, Microsoft AI Native Team
Audit & Reporting
Every Kernel decision is logged immutably in under a millisecond. Not just the verdict, which governance layer triggered, what the agent declared, which OWASP risk applies, who approved it, the full execution chain.
Queryable by any field. Mapped to the regulation, article by article.
Kernel doesn't bolt compliance on. Every consequential agent action maps to a specific obligation. Here's what your auditor will see.
Human oversight, deterministic.
REQUIRE_HUMAN routes consequential actions to a reviewer before execution. Every approval logged with identity, timestamp, and policy anchor.
Record-keeping by architecture.
Every decision signed, timestamped, tamper-evident. Exportable in EU AI Act format on demand. 7-year retention by default.
Decisions in plain language.
Every verdict comes with a written narrative: declared intent, OWASP risk, regulatory anchor. Auditors can read it without an engineer in the room.
SentinelEvery decision signed. Every execution reconciled.
Every decision is signed with Ed25519, hash-chained, and tamper-evident, then streamed into the SIEM you already run, Datadog, Splunk, Sentinel, or your own.
Your execution layer confirms back through the Execution Confirmation API, and what ran is reconciled against what was approved.