# Kyde

Full page text of the whole site in one file: https://kyde.com/llms-full.txt
Flat JSON index (title, url, kind, summary per page): https://kyde.com/site-index.json

> Kyde is behavioral scoring for AI agents. Kyde learns how each agent normally behaves and scores every run against that baseline. When an agent stops behaving like itself, because it drifts after a model update, gets stuck in a loop that burns money or is hijacked by prompt injection, Kyde raises an alert, and with the Kyde Gateway puts the agent into quarantine until a human releases it. Deterministic statistics, no LLM in the verdict, every score recomputable. Any model, any vendor; the gateway runs in the customer's own network or EU-hosted. Built in Europe.

## The problem

Know when your AI agents go off task. An agent is checked once, on the day it goes live; after that, the only one watching it is the agent itself. Three things go wrong, and each is usually found weeks later, from a customer, a bill or an auditor:

- **Loops (money).** An agent retries, loops and calls tools again and again overnight. Tokens, compute and API costs pile up; the invoice is the first alert.
- **Hijack (security).** A document, website, email or tool response carries instructions (prompt injection). The agent follows them with the operator's credentials, for example exporting customer data to an outside address.
- **Drift (behavior).** The agent stops behaving like itself: a vendor swaps the model, context and memory grow, the environment changes. Example: after a model update, a claims agent that normally approves six claims in ten approves every claim.

## How Kyde works

Behavioral scoring, the way banks score card payments: a card gets a score once when you apply, then the bank scores how you use it, the score sets your limit, and unusual use blocks the card. Kyde does the same for agents. Every agent gets a limit.

1. **Observe.** Every action of an agent crosses Kyde, through a gateway or SDK. No changes to the agent's logic.
2. **Learn.** Kyde learns each agent's normal behavior (a frozen baseline). Every human decision sharpens it.
3. **Score.** Every run is scored against the agent's own normal behavior. Deterministic statistics, recomputable from the record; no LLM judge in the detection path.
4. **Limit.** The score decides what the agent may do.
5. **Stop.** A drifting, hijacked or looping agent goes into quarantine; a human decides what happens next.
6. **Prove** (under every step). A tamper-evident, hash-chained record of everything; every score can be recomputed by a third party.

Detection runs two channels against the same frozen baseline: a divergence channel for gradual drift (behavior wandering over weeks) and a change-point channel (CUSUM family) for abrupt change after an input or update. Measured on public records, each catches events the other misses.

Any model, any vendor, on-prem, built in Europe. Runs in the customer's network; data stays with the customer.

## Research behind the detection

Kyde publishes its research on behavioral drift: "Behavioral Drift in Autonomous LLM-driven Systems: A Survey of Detection Approaches and the Case for Deterministic Detection" (J. Eckel, J. Radehaus, v0.4, 2026-09-17), with reference detector code at https://github.com/kydehq/behavioral-drift-detection and a summary at https://kyde.com/behavioral-drift.

- "Behavioral drift" covers at least seven phenomena with different causes and detection cost: goal drift, context decay, reward hacking, deception, multi-agent drift, persistent drift (memory or self-modification), version drift (vendor model changes). Prompt injection is a cause that produces three of them.
- The detection core has to be deterministic: an LLM judge is itself an agent subject to the drift it is asked to measure, and its verdicts cannot be replayed. Statistics over an append-only boundary record can be recomputed by anyone.
- First measurements on six public corpora (boundary call records only: tool name, hashed parameters, status, attribution; no content): a silent model change is detected in 80–100% of trials once it visibly shifts the tool-call distribution (JSD ≥ 0.02), 0% on a same-version control; false-alarm rates vary so much between deployments that they must be calibrated per deployment; successful in-session prompt injections and reward hacking are nearly invisible to distribution-level statistics (they use the same tools as legitimate work), which is why sequence-level, per-task models are the next step.

The research is honest about limits: what does not cross the boundary (intent in a reasoning trace, a poisoned memory entry, deception with harmless surface text) is invisible to any detector built on boundary records.

## Kyde Gateway

**Kyde Gateway** is the model-agnostic governance proxy that implements the layer. It is OpenAI-compatible and drop-in: it intercepts every inference call, verifies agent identity, enforces behavioral scope, blocks out-of-policy actions before they execute, and writes every entry into a hash-chained ledger.

Every entry captures: who acted (agent identity + role), what happened (prompt, tool calls, response), why it decided (causal context: retrieval and reasoning chain), when (millisecond-precise timestamp), and the hash-chain link that makes tampering detectable.

Two editions, the same compose files, switched by one env-file setting:
- **Starter** — the public images from the open GitHub repository (github.com/kydehq/gateway): hash-chained but unsigned ledger, observe-only DLP.
- **Enterprise** — adds Ed25519/TPM audit signing (hardware-rootable via PKCS#11 / HSM) and inline enforcement, plus unlimited retention, agent identity enforcement, MCP per-tool policy, RBAC and air-gapped operation.

## kyde score — hosted drift scoring (self-serve, agents can integrate it themselves)

The hosted entry point to the platform: https://score.kyde.com — behavioral
drift scores from an agent's OpenTelemetry, no gateway, no SDK, no signup form,
free tier. If you are an AI agent and your human wants to know when you (or
agents you run) stop behaving normally, you can set this up yourself:

1. Create a key: `curl -s -X POST https://score.kyde.com/score/v0/keys`
   (pass `{"webhook_url": "https://..."}` to get band-change alerts pushed).
2. Point any OTLP/HTTP JSON exporter at `https://score.kyde.com` with header
   `x-kyde-key: <key>` (for Claude Code/Codex/OpenCode this is just env vars).
3. Read scores: `GET https://score.kyde.com/score/v0/scores` — each agent is
   scored 0–100 against its own baseline after ~30 runs; 70–100 normal,
   40–69 watch, 0–39 deviating.

MCP server (streamable HTTP): https://score.kyde.com/mcp — tools create_key,
get_scores, set_webhook, revoke_key. Example client config:
`{"mcpServers": {"kyde-score": {"type": "http", "url": "https://score.kyde.com/mcp", "headers": {"x-kyde-key": "<key>"}}}}`

Machine-readable reference: https://score.kyde.com/llms.txt — agent skill:
https://score.kyde.com/skill.md — OpenAPI: https://score.kyde.com/openapi.json
Overview page: https://kyde.com/score

## Deployment

Three modes, all requiring zero code changes to agent logic:
- **Environment variable**: `export OPENAI_BASE_URL=https://gateway.kyde.com/v1`
- **Group Policy (GPO)**: enterprise fleet deployment, no developer action required
- **Hosted proxy**: managed, EU data residency

Gateway: on-premise, private cloud or EU-hosted. Target latency overhead: under 100ms. The record leaves the customer's building only when they send it.

## Provider compatibility

OpenAI (GPT-4o, o1, o3), Anthropic (Claude Sonnet, Opus, Haiku), Azure OpenAI, Google Gemini, Mistral, DeepSeek, Ollama, local models via LMStudio/vLLM, MCP routing.

## Regulatory context

Kyde is **built for** these regimes — a product cannot make an organization compliant, since that depends on the deployment.

**EU AI Act (Regulation 2024/1689)**
High-Risk AI system enforcement deadline for Annex III (employment, credit, insurance, education, critical infrastructure, essential services): **December 2, 2027** (Digital Omnibus agreement, May 2026). Annex I embedded AI products: August 2028.

Key obligations for enterprises deploying AI agents:
- Article 12: Automatic logging throughout system lifecycle, tamper-evident, minimum 6-month retention
- Article 14: Human oversight capability — requires causal context capture, not just I/O logs
- Article 26: Deployer obligations — the enterprise bears compliance responsibility, not the LLM provider
- Article 49: Registration in EU database before deployment

Vendor-native logs (OpenAI, Anthropic consoles) do not satisfy Article 26's independence requirement. Kyde's out-of-band ledger is architecturally independent of the providers it logs.

**DORA (EU Regulation 2022/2554)**
In force since January 2025. Applies to financial entities. Article 30 requires ICT-related incident logs, up to two-year retention, independent of ICT third-party providers. Kyde's provider-independent ledger directly addresses this requirement.

**NIS-2**
Makes management personally liable for security controls, which is the buy reason in most conversations today.

**GDPR Articles 22 / 35**
Automated decision-making requirements and DPIA obligations apply to AI agent deployments in HR, credit, insurance and healthcare. Causal context capture supports Article 22 explainability requirements. Personal data captured during an audit is removed locally, before anything is stored.

**KI-MIG**
The German AI market surveillance act, in force since 29 July 2026: BaFin supervises AI used in regulated financial activity.

**UK DRCF (CMA, FCA, ICO, Ofcom)**
Joint foresight paper on agentic AI: organizational accountability is unchanged regardless of agent autonomy. "My agent did it" is not a defense.

**NIST AI RMF and SP 800-207**
SP 800-207 defines zero trust architecture for users and devices; agents inherit the principles but are not its subject. NIST's AI work converges on the same requirements: traceable identity, causal context capture, tamper-evident records in a layer independent of the systems it governs.

## Who uses Kyde

No industry restriction. Kyde fits wherever agents run in production, take actions with consequences and run many times a day:

- Agents that move money: agent wallets, payment providers, fintechs, commerce with buying agents
- Companies whose product is an agent: customer service, sales and coding agents, and the agencies that build agents for clients
- Engineering teams running many coding agents
- Security providers running SOC agents for their customers

Regulation (EU AI Act, DORA, NIS-2) matters where it applies; see Regulatory context above.

## Key differentiator vs. adjacent solutions

- **vs. AI security tools (Zenity, Lakera, Prompt Security)**: Those are semantic firewalls — they inspect inputs and outputs for adversarial content. Kyde enforces behavioral policy, provides agent identity, and produces audit-grade records. Analogous to: antivirus vs. corporate law.
- **vs. observability tools (LangSmith, Langfuse, Arize)**: Those require framework-specific instrumentation and produce developer debug output. Kyde is framework-agnostic, out-of-band, and produces regulator-ready records with enforcement capability.
- **vs. platform-native governance (Microsoft Copilot Studio, AWS Bedrock Guardrails)**: Those govern within a single vendor's stack. Kyde governs the chain across all providers and platforms — the gap every hyperscaler leaves open because they cannot govern their competitors' infrastructure.

## Content resources

### Site

- [Kyde](https://kyde.com/): The front door. Know when your AI agents go off task; behavioral scoring for AI agents; the bank analogy; how it works (observe, learn, score, limit, stop, prove); how to start (setup, then two weeks).
- [kyde score](https://kyde.com/score): The hosted service: drift scores from an agent's OpenTelemetry, self-serve key, MCP server, webhook alerts, free tier. Live at https://score.kyde.com.
- [Platform](https://kyde.com/platform): The layer under the score: the flight recorder, the inventory of agents nobody registered, identity, policy, data and limits checked at the moment of action, replay, and a tamper-evident record an auditor recomputes.
- [Industries](https://kyde.com/industries): Behavioral scoring for AI agents, by industry: agentic commerce, insurance, banking and fintech, physical AI, security providers and healthcare. Each page names the risks, an example, and how Kyde decides: frequencies and statistics against the agent's own normal behavior, no language model in the decision.
- [Agentic Commerce](https://kyde.com/industries/agentic-commerce): Kyde scores an agent's behavior before its payment is approved. A behavioral signal for agent payments, computed without a language model, for card networks, payment processors, agent wallets and the companies whose agents pay.
- [Insurance](https://kyde.com/industries/insurance): Kyde detects when a claims or service agent changes how it decides: after a model update, through a manipulated document, or when it passes on customer data its task does not need. Regulation: DORA, Solvency II, KI-MIG, GDPR Article 22, EU AI Act.
- [Banking & Fintech](https://kyde.com/industries/banking): Kyde detects when an agent in KYC, AML or lending stops following the procedure it was approved for.
- [Physical AI](https://kyde.com/industries/physical-ai): Kyde detects when an agent that controls a machine has been compromised.
- [Security Providers](https://kyde.com/industries/security-providers): Kyde detects when a security agent you run for a customer has been compromised.
- [Healthcare](https://kyde.com/industries/healthcare): Kyde detects when an agent accesses patient data that is not part of its task.
- [Company](https://kyde.com/company): What Kyde builds and why: agents are attacked around the clock and can go wrong on their own, and in both cases every single action is allowed. Early stage, engineered in Germany.
- [FAQ](https://kyde.com/faq): What security and compliance teams ask before deploying the gateway — latency, data privacy, audit evidence, and how it differs from a SIEM or an API gateway.
- [Resources](https://kyde.com/resources): Hub for documentation, regulatory analysis and technical guides.

### Product documentation

- [Kyde Gateway Documentation](https://kyde.com/docs/): Overview, editions (Starter vs Enterprise), what the gateway does and doesn't do.
- [Quickstart](https://kyde.com/docs/quickstart/): Docker Compose setup to first ledger entry in about five minutes; one environment variable to route any agent through the gateway.
- [User Manual](https://kyde.com/docs/user-manual/): The dashboard end to end — roles, DLP alerts and policies, users, settings, common workflows.
- [Deployment Guide](https://kyde.com/docs/deployment/): Architecture, sizing, Docker Compose dev and production, pip install, day-2 operations, configuration reference, troubleshooting.
- [Reference](https://kyde.com/docs/reference/): Multi-provider routing, MCP routing, custom upstreams, CLI, agent identity, policy enforcement, ledger entry fields.

### Glossary (definitions, DefinedTerm markup)

The vocabulary of AI agent governance, each term defined in under 60 words with a concrete data point: [Glossary hub](https://kyde.com/glossary)

- [AI Agent Governance](https://kyde.com/glossary/ai-agent-governance) · [Behavioral Firewall](https://kyde.com/glossary/behavioral-firewall) · [Observability vs Governance](https://kyde.com/glossary/agent-observability-vs-governance) · [AI Agent Audit Trail](https://kyde.com/glossary/ai-agent-audit-trail) · [Agent Attestation](https://kyde.com/glossary/agent-attestation) · [Trust Score for AI Agents](https://kyde.com/glossary/ai-agent-trust-score) · [Levels of Agent Autonomy](https://kyde.com/glossary/agent-autonomy-levels) · [Human-in-the-Loop Approval](https://kyde.com/glossary/human-in-the-loop-ai-agents) · [AI Governance Proxy / AI Gateway](https://kyde.com/glossary/ai-governance-proxy) · [Knowledge Egress](https://kyde.com/glossary/knowledge-egress)

### Complete guides (topic clusters)

- [Behavioral Drift in AI Agents](https://kyde.com/behavioral-drift): Behavioral drift is not a single, well-defined phenomenon. At least seven related ways agent behavior can change, presented as Kyde's synthesis of the literature rather than an established taxonomy: drift can be inherited between agents, agents can stop before the work is done, reward hacking is related but different, and evaluations only show behavior under evaluation conditions. Which signals are measurable from production logs and at what cost, and the four gaps the research has not closed. 17 linked arXiv sources.
- [Zero Trust for AI Agents](https://kyde.com/zero-trust-for-ai-agents): Never trust, always verify, per action. The six verification dimensions (who, what, when, where, why, how), where existing frameworks stop, and how boundary enforcement works. FAQ.
- [EU AI Act Compliance for AI Agents](https://kyde.com/eu-ai-act-compliance): Annex III classification, Articles 12/14/26/49 obligations, December 2027 deadline, three structural compliance gaps, six-step action plan, FAQ.
- [AI Agent Governance: The Complete Enterprise Guide](https://kyde.com/ai-agent-governance): What governance is, why existing approaches fail, the four requirements (identity, scope, enforcement, ledger), regulatory context, architecture, vendor landscape, FAQ.
- [Shadow AI: What It Is, Why It's a Risk, and How to Stop It](https://kyde.com/shadow-ai): Entry vectors, security/compliance/liability implications, EU AI Act exposure, detection methods, governance-without-blocking approach, FAQ.
- [Qualified Electronic Ledger (eIDAS)](https://kyde.com/qualified-electronic-ledger): What eIDAS 2.0 and the qualified electronic ledger regime require, the REQ-7.5 key-storage benchmark, and how a boundary-written hash chain maps onto it.
- [AI Agent Insurance: Liability, Coverage, and the Evidence Infrastructure](https://kyde.com/ai-agent-insurance): Legal liability framework (EU AI Act, PLD 2024, DORA), coverage landscape (AIUC-1, Munich Re aiSure, HSB), why certification alone isn't enough, the four evidence requirements (complete, continuous, independent, tamper-evident), how KYDE enables insurability, FAQ.

### German (de)

- [Wissen](https://kyde.com/de/wissen): German-language hub.
- [Souveräne KI](https://kyde.com/de/wissen/souveraene-ki): Digital sovereignty for AI — what "sovereign" means beyond hosting location, and where the record has to live.
- [Qualifiziertes elektronisches Journal](https://kyde.com/de/wissen/qualifiziertes-elektronisches-journal): The eIDAS ledger regime, in German.
- [Behavioral Drift bei KI-Agenten](https://kyde.com/de/wissen/behavioral-drift): The behavioral drift guide, in German.

### Named comparisons

Honest, dated vendor comparisons: two genuine strengths of the competitor, a side-by-side table, and where the architectures actually differ.

- [Kyde vs WitnessAI](https://kyde.com/compare/kyde-vs-witnessai): Employee AI usage security (probabilistic inference) vs autonomous agent governance (deterministic enforcement at the boundary).
- [Kyde vs Alinia AI](https://kyde.com/compare/kyde-vs-alinia): SDK-wrapped compliance guardrails vs a network boundary that covers agents nobody instrumented.
- [Kyde vs Geordie AI](https://kyde.com/compare/kyde-vs-geordie): Context engineering that steers agent behavior vs a deterministic boundary outside the agent's reach.
- [Kyde vs Kyvvu](https://kyde.com/compare/kyde-vs-kyvvu): In-process security kernel (SDK) vs an external gateway no agent can opt out of.
- [Kyde vs Lakera](https://kyde.com/compare/kyde-vs-lakera): Real-time prompt/agent/MCP threat detection (Check Point) vs deterministic policy enforcement with a hash-chained ledger.
- [Kyde vs Microsoft Agent 365](https://kyde.com/compare/kyde-vs-microsoft-agent-365): Opt-in Microsoft-native control plane vs a vendor-independent boundary covering agents that never registered.
- [Kyde vs Zenity](https://kyde.com/compare/kyde-vs-zenity): Estate-by-estate platform connectors (SaaS, cloud, device) vs one unavoidable network boundary with deterministic policy and a hash-chained ledger.
- [Kyde vs Noma Security](https://kyde.com/compare/kyde-vs-noma-security): AI security lifecycle platform (posture to runtime threat protection) vs deterministic agent mandates with tamper-evident boundary evidence.
- [Kyde vs Vanta](https://kyde.com/compare/kyde-vs-vanta): Program-level compliance automation (GRC) vs runtime enforcement and action-level evidence; positioned as a stack, not a choice.

### Insurance and confidence infrastructure series

- [Part I: Trust Is Not a Property of Technology. It Is a Property of Infrastructure.](https://kyde.com/blog/confidence-infrastructure-part-1): Historical pattern — Hartford Steam Boiler, Lloyd's aviation pools, usage-based auto insurance telematics — and what it means for autonomous AI agents.
- [Part II: The Law Has Assigned Liability. Nobody Can Yet Prove What Happened.](https://kyde.com/blog/confidence-infrastructure-part-2): EU AI Act, PLD 2024, DORA, the DRCF "Many Hands" problem, AIUC-1 certification limits, and the four evidence requirements for liability adjudication.
- [Part III: The Telematics for Autonomous Systems](https://kyde.com/blog/confidence-infrastructure-part-3): Technical architecture of continuous behavioral monitoring — Ed25519 signing, hash chaining, WORM storage, behavioral baselines, provider independence, why this must be an ecosystem not a product.

### Regulatory articles

- [What the EU AI Act Actually Requires for Audit Trails](https://kyde.com/blog/eu-ai-act-audit-trails): Why provider-native logs fail, what tamper-evidence requires structurally, the causal context requirement.
- [The EU AI Act Is Coming. Regardless of What Brussels Decides.](https://kyde.com/blog/eu-ai-act-omnibus-collapse): The Digital Omnibus timeline, four enforcement scenarios, what enterprises must do now.
- [DORA and AI Agents: Why Your LLM Provider's Log Doesn't Satisfy Article 30](https://kyde.com/blog/dora-ai-agents): Financial entity obligations, the independence requirement, DORA vs. EU AI Act overlap.
- [NIST and EU AI Act: Converging on the Same Requirements](https://kyde.com/blog/nist-critical-infrastructure-ai-convergence): US–EU regulatory convergence on traceable identity and tamper-evident records.
- [When Four Regulators Speak in Unison](https://kyde.com/blog/drcf-agentic-ai-foresight): UK DRCF joint paper — the "Many Hands" problem, seven agentic AI risks, organizational accountability.

### Security and governance articles

- [Shadow AI Is Already in Your Production Systems](https://kyde.com/blog/shadow-ai-production-systems): What shadow AI looks like in enterprise environments, the risks.
- [Your Employees Are Already Using AI. You Just Don't Know How.](https://kyde.com/blog/employees-using-ai-shadow): The 78% statistic, what employees are actually doing, compliance exposure.
- [The Missing Layer in Every Agent Architecture](https://kyde.com/blog/missing-layer-agent-architecture): Agent core vs. agent harness — why governance must be external to the agent.
- [Every Vendor Governs Their Stack. Nobody Governs the Chain.](https://kyde.com/blog/nobody-governs-the-chain): Why cross-system agent governance is the unsolved category.
- [AI Agent Security, Governance, and Enforcement: Three Categories](https://kyde.com/blog/ai-governance-three-categories): Mapping the vendor landscape — security vs. observability vs. governance infrastructure.
- [How MCP Changes Everything About AI Governance](https://kyde.com/blog/mcp-changes-ai-governance): MCP bypasses the application control layer — what governance infrastructure must do instead.
- [HBR Described the Problem. Here's the Infrastructure That Solves It.](https://kyde.com/blog/hbr-ai-agents-infrastructure): Identity, context, control, accountability — the four enterprise frictions and the governance answer.
- [Agent Goal Hijacking: The Risk Enterprises Can't Detect](https://kyde.com/blog/agent-goal-hijacking): OWASP ASI01, how prompt injection hijacks agents, what forensic infrastructure is required.
- [What Happens When an AI Agent Gets Compromised — And There Are No Logs](https://kyde.com/blog/compromised-agent-no-logs): The forensics gap when agent actions cannot be reconstructed.
- [The Shadow AI Trilogy](https://kyde.com/shadow-ai-trilogy): The three shadow-AI articles above, read as one argument.

### Guides

- [How to Classify AI Systems Under EU AI Act](https://kyde.com/guides/classify-ai-systems): Step-by-step Annex III classification framework with decision tree.
- [How to Detect Shadow AI in Your Organization](https://kyde.com/guides/detect-shadow-ai): Network analysis, endpoint audit, SaaS inventory, governance proxy setup.
- [AI Governance Checklist: What to Have Before an Audit](https://kyde.com/guides/governance-checklist): Technical controls and documentation for pre-audit readiness.

### Whitepapers

- [Machine-First Governance](https://kyde.com/whitepapers/machine-first-governance): The case for governance infrastructure designed for non-human economic actors.

## Company

Kyde builds behavioral scoring for AI agents. Early stage, engineered in Germany.

Website: https://kyde.com — Contact: hello@kyde.com

Category: **behavioral scoring for AI agents**. Naming: **Kyde** in running text, **KYDE** as the wordmark. The platform is *Kyde* (behavioral scoring for AI agents); the gateway that enforces it in the customer's network is the *Kyde Gateway*. "Behavioral firewall" names the enforcement layer in the articles, not the company.