Per-action runtime authorization
Checks every prompt, tool call, shell command, database query, API request, and workflow step before execution, then allows, denies, or routes the action for approval.
Kastra
Kastra authorizes AI actions before execution, with policy checks for prompts, tool calls, shell commands, database queries, API requests, and browser actions.
Overview
Kastra is an authorization layer for AI systems. It sits between an AI agent or tool and the target system, checking each action against policy before anything executes. The product is positioned for prompts, shell commands, database queries, API requests, browser actions, and autonomous workflows.
The site describes a control plane that combines runtime authorization, a policy engine, enforcement on local machines and in backend services, and a signed audit trail. Kastra also includes Recon for reviewing historical agent activity and drafting policies from risky actions already taken.
Core capabilities
Policy engine with reviewable rules
Lets teams write policy as code, with typed, versioned rules and a policy playground for testing changes against live requests.
Local and fleet-wide enforcement
Runs enforcement on developer laptops and across agents, browsers, and backend services with the same policy language and decision model.
Signed audit trail and exports
Produces signed, append-only decision records that can be replayed and exported to SIEM tools or object storage.
Kastra Recon for historical review
Scans prior agent activity with Recon, flags risky historical actions, and drafts policies from what it finds.
Shadow mode rollout
Supports shadow mode, so teams can observe decisions and policy fit before turning on blocking enforcement.
Practical use cases
Govern coding agents on local machines
Use Kastra to stop destructive or risky terminal commands from running on developer laptops, such as force pushes or bulk deletions, while still allowing approved coding workflows.
Control autonomous browser actions
Apply policies to browser agents so clicks, form fills, navigation, and downloads are checked before the DOM event fires, with approval gates for sensitive steps.
Protect production data and services
Use runtime checks for database and API operations in production workflows, where actions can be allowed, denied, or escalated based on actor scope, target, and intent.
Roll out governance gradually
Run in shadow mode first to observe live AI activity, then promote the same policies to enforcement once the rules fit real traffic.
Backfill policies from past agent activity
Scan prior agent history with Recon to identify risky actions already taken and generate draft policies before enforcement is turned on.
Pros and Cons
Pros
- Checks AI actions before execution rather than only logging or filtering after the fact.
- Covers several action types, including shell, browser, database, API, and workflow steps.
- Offers a shadow mode for low-risk rollout before enforcement.
- Provides signed, replayable audit evidence and export paths to common systems.
- Includes Recon for backfilling policy from past risky actions.
Cons
- The public materials are stronger on architecture and examples than on full integration reference documentation.
- Some deployment, compliance, and enterprise capabilities are listed at a high level only, so readers may still need confirmation before adopting it in a regulated environment.
FAQ
What does Kastra do?
Kastra authorizes AI actions at execution time. It evaluates the actor, scope, action, and destination, then returns allow, deny, or route-for-approval before the action runs.
Can Kastra run locally or be self-hosted?
Yes. The site says Kastra can run locally on a machine, and the pricing page includes local machine governance and Kastra Edge local enforcement on lower tiers, with self-hosted and air-gapped options listed for enterprise.
Which AI agents and runtimes are supported?
The site shows support for Claude Code, Codex CLI, Cursor, OpenClaw browser agents, OpenAI-compatible runtimes, and custom internal agents through SDKs.
How does auditing work?
Kastra uses a policy engine and returns signed, hash-chained evidence for each decision. The site also describes audit exports and streaming to systems such as SIEM, Datadog, Splunk, and S3.
Can teams test before blocking actions?
Kastra starts in shadow mode so teams can observe AI runtime activity before enforcing policies. The pricing page describes a progression from observation to enforcement.
Quick Facts
- Category
- AI authorization / developer tool
- Primary use
- Control what AI agents are allowed to do before execution
- Deployment models
- Cloud, self-hosted, BYOC, and air-gapped are referenced on the site
- Supported surfaces
- Prompts, tool calls, shell commands, database queries, API requests, browser actions, and workflows
- Pricing
- Free, Pro, Team, and Enterprise plans are listed
- Website
- kastra.ai
Kastra Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.
Macuse
Macuse is a macOS app that lets AI assistants control native Mac apps through MCP and use Computer Use for any app, with on-device automation.