Skip to content

Product

A verification boundaryfor agent actions.

KEMSafe sits between your agents and the tools they call. It checks who is acting and what they may do on every action, weighs consequential actions against their evidence, and decides before anything runs.

Book a demoHow it decides

Agent runtimes

Plan each call and propose it

Your systems

Reached only by allowed actions

KEMSafe boundary

Evaluates each action before it runs

crm-agentsupport-agentinvoice-agentWarehouseCRMPaymentsIdentity provider
crm.export
payments.create
iam.grant
crm.update
  • Agent runtimespropose actions
  • KEMSafe boundaryevaluates each one
  • crm.updateRuns in the CRM
  • crm.exportHeld for the data owner
  • payments.createWaiting with its evidence
  • iam.grantRefused
Illustrative. Four actions arrive at the boundary: an update runs, an export waits for its data owner, a payment waits with its evidence, and a grant from an unverified caller is refused.

One boundary, five questions. Two are asked of every action. Three are asked of consequential ones.

KEMSafe sits between your agents and the tools they call. Identity and policy are deterministic and run on every action. Consequential actions are also weighed against their evidence and the agent’s usual behaviour, and the hard cases go to a person.

  1. 1IdentityIs this a known agent, with a valid key that has not been revoked?Deterministic. Every action.
  2. 2Capability and policyMay this agent take this action, with these values?Deterministic. Every action.
  3. 3EvidenceDoes the action follow from sources it can trust?Proof-of-Intent, provenance and injection signals. Consequential actions.
  4. 4BehaviourIs this normal for this agent?Consequential actions.
  5. 5Human reviewShould a person decide?When the evidence is not enough.
  6. 6Your systemsOnly actions that clear the boundary reach them.Downstream.

Follow an action through it

  1. IdentityWaiting
  2. Capability and policyWaiting
  3. EvidenceWaiting
  4. BehaviourWaiting
  5. Human reviewWaiting

The line on the right is the decision record. Every plate writes to it.

Illustrative. Which actions count as consequential is set in your policy.

What the boundary is made of. Eight capabilities, each doing one job.

Deterministic controls are marked with a solid dot; checks that weigh evidence carry a point of light.

support-agentValid
Key
4f1c
Expires
in 14 minutes
Revoked
No

Short-lived, revocable credentials

Agent identity

policy.jsonprototype format
"payment.request": {
  "risk_tier": "HIGH",
  "require_proof_of_intent": true,
  "human_review_above_amount": 5000
}

Declarative rules per action

Capability policy

support-agent states

“Ticket 8812 asks for all contacts to be exported for a CRM migration.”

confidence 0.91input sha256:8548…b82a

Treated as evidence, never as authority

Weighed against

  • The sources it read
  • Its identity and permissions
  • Its usual behaviour
  • Your policy

The agent states what it is doing and why

Proof-of-Intent

destinationticket:8812segmentticket:8812rowscrm.search

Where every value came from

Provenance

last 14 exports18,400 rows

Pattern, frequency, anomaly

Behaviour signals

crm.exportNeeds you

18,400 contacts to partner-drop.example, asked for by ticket 8812.

The right person, with the evidence

Human review

payments.create

£48,000 to Northwind Supply

  • Amount within PO-2291
  • Payee account only on the invoice

Held in place until confirmed

Quarantine

  1. 09:38:12crm.update
  2. 09:41:05crm.export
  3. 09:44:31payments.create
  4. 09:47:58iam.grant

Every decision, attributable

Decision record

Deterministic where it can be. Careful where it must be.

Identity and policy are deterministic checks, designed for low latency, and they decide routine actions. Evidence, behaviour and review are reserved for the actions that can do damage.

Interface fragments are illustrative, not screenshots of a shipped product. KEMSafe is in private pilot.

Four requests, four answers. Step through what is checked, what is found and what is decided.

Actions from four agents, as they might arrive in one morning. Pick one and step through what KEMSafe checks, what it finds and what it decides.

Decisions

Illustrative simulation, not connected to a live engine

support-agent

crm.export

18,400 records to partner-drop.example

Held for review

Held for review. The data owner sees the export, the ticket and the destination before anything leaves.

  • IdentityKnown agent, key valid and not revoked
  • Capabilitycrm.export is granted to support-agent
  • EvidenceThe instruction and the destination come from an outside sender
  • BehaviourIts largest export so far was 200 records
  • PolicyExports over 1,000 records to a new destination need the data owner

Decision record

Decision
dec_7q2f9
Agent
support-agent
Policy
exports.external
Outcome
Held for review
Next
Waiting for the data owner
Recorded
21 Oct 2026, 09:41:05 UTC

Before it runs, an action is data. What the agent wants to do, with which values, where each value came from and why it believes it should. That is what KEMSafe evaluates, and what it keeps.

action-request.json

JSON

{  "session_token": "<signed session for invoice-agent>",  "action": "payment.request",  "resource": "invoice:INV-2847",  "input_hash": "sha256:d29f9a3b0b44d1174e59b360d87b97c5a4ced889f499b10dd6933443270579d7",  "proof_of_intent": {    "action": "payment.request",    "reasoning": "Invoice INV-2847 matches contract VC-2024-089.",    "confidence": 0.94  },  "metadata": {    "payee": "Northwind Supply",    "account": "0419",    "amount": 48000  },  "provenance": {    "payee": ["vendor_record", "purchase_order"],    "account": ["invoice_pdf"],    "amount": ["invoice_pdf", "purchase_order"]  }}

Request, policy and decision fields follow the prototype gateway; the provenance block follows the method in our research. Illustrative values; not a published API.

Anywhere an agent can move money, data or access. The first use cases are digital: support, payments, CRM, data exports, DevOps and internal automation.

  • Order 55120

    Refund£1,240.00
    Requested by email only

    Customer support agents

    refund.issue

    Refunds a customer on the strength of an email nobody can verify.

    KEMSafe asks. Does the order exist, and does the refund match it?

    Held for review
  • InvoiceVC-2024-089
    Pay into account
    0419
    Vendor record
    7730

    Finance and payments

    payments.create

    Pays an invoice into an account that only the invoice vouches for.

    KEMSafe asks. Does the payee account match the vendor record?

    Quarantined
  • edited
    edited
    edited

    and 4,200 more

    CRM and sales operations

    crm.bulk_update

    Rewrites thousands of leads because one note asked it to.

    KEMSafe asks. Who asked, and is this the agent’s usual scale?

    Held for review
  • svc-reportingrole: admin

    Internal admin automation

    iam.grant

    Grants admin access to a service account a document named.

    KEMSafe asks. Is the caller verified, and is there a matching request?

    Blocked
  • unreviewedproduction

    Developer and source control

    deploy.release

    Ships to production from a branch nobody has reviewed.

    KEMSafe asks. Was the change reviewed, and is the window open?

    Held for review
  • Retained

    Regulated operations

    records.delete

    Deletes records that must be retained for an audit.

    KEMSafe asks. Is any of this data under a retention rule?

    Blocked

Illustrative. Outcomes depend on the policies your team sets.

Bring us the action you’d least likean agent to take.

Thirty minutes with the founders. We’ll map where KEMSafe would sit in your stack and which actions it would hold.

Book a technical demoAsk about the private pilot

KEMSafe is in private pilot. Or write to founders@kemsafe.dev