A governed path for company-built agents to supported models, services, and other agents. Identity, deterministic policy, and metadata-safe activity are enforced at the gateway.
From agent identity to governed delivery and recorded activity.
Register once. Give each agent its own scoped KRNLA credential. Rotate, revoke or disable access from the control plane.
Define rules in the dashboard. The Gateway applies deterministic decisions to supported calls before transport.
Configure an inbox connection. Governed content is queued for the destination agent to retrieve and acknowledge with its own credential.
Review bounded decision and delivery metadata. Observed relationships come from acknowledged governed agent messages.
The Python and TypeScript SDKs send supported LLM and agent-to-agent operations through the Gateway. Policies apply there without policy code inside each agent.
Define conditions in the control plane. Attach actions. No policy logic lives inside your agents because it does not need to. The gateway enforces consistently, regardless of which agent makes the call.
Evaluate the current policy set against bounded facts before enabling a change.
The gateway asynchronously emits bounded metadata describing decisions, matched policy, outcomes, and time. Request and response bodies are not stored in activity records. Guaranteed audit delivery remains future work.
agent_idtarget_iddecisionpolicy_idtimestampduration_mstransport_outcometrace_idopenai.responses.create via retrieval-agent
ALLOWresearch.completed — blocked by current policy
BLOCKopenai.responses.create — response contains PII
REDACThandoff.ready — acknowledged by registered agent
ALLOWKRNLA records observed relationships from governed agent activity. Historical evidence, not configured routing.
Infrastructure that keeps security properties without requiring policy authors to reason about them manually.
Activity records contain metadata and decisions only. Inbox message payloads are stored encrypted with a 24-hour TTL and cleared earlier on acknowledgement or terminal state where implemented.
Agent messages enter a policy-governed KRNLA inbox. Destination agents retrieve them with their own scoped credentials and acknowledge completion.
Agent credentials identify one agent. Provider credentials remain server-side and are never returned to agents.
Asynchronous activity stores metadata and policy decisions under explicit retention limits. Guaranteed audit durability remains future work.
Dashboard access is gated by organisation, role, and resource. No cross-tenant data exposure.
Evaluate the current policy set against bounded facts before enforcement. The current simulator does not replay historical traffic.
Install the Python or TypeScript SDK, add one bootstrap call, and route supported agent messages or LLM requests through its governed methods.
Register your agent in the KRNLA dashboard and receive a gateway credential.
Set the Gateway origin and one-time KRNLA agent credential in your server-side environment.
Create rules against the agent, destination, and request. No code to deploy.
Governed paths emit bounded metadata about policy decisions and delivery outcomes.
KRNLA is accepting public beta access requests. Verify your identity, then wait for approval before entering the production console.
Production service · beta admission