(Platform)
Observe. Learn. Score. Stop.
The gateway under behavioral scoring. Every action of an agent crosses it, is recorded, scored against the agent's own normal behavior, and stopped when that behavior changes.
It sits between your agents and the models, tools and systems they reach. Any model, any vendor, on-prem. One boundary, four chapters.
Record every AI action.
Humans · Agents · Tool calls · Approvals
Every action an AI system takes crosses one layer, and that is where it stops being traffic and becomes a record. Who acted, under whose identity, against which model, reaching which system. Written as it passes, not reconstructed afterwards from four vendor consoles that each saw a different part of it.
FIG.1 · Every step appends a link. The work writes the record as it happens.
Five of these seven run under an id nobody has claimed.
Find the agents nobody put on a list.
Scanning does not stop after the first sweep.
Identity · Provider · Model · Reach
Most agents run under a shared API key, indistinguishable from each other and from the people whose credentials they borrowed. Kyde gives each one an identity of its own, so every action carries a name before it happens and the inventory builds itself: which providers, which models, which tools each agent reaches. A new agent appears on the board the first time it acts.
Every agent is scored against its own normal behavior.
Kyde learns what normal looks like for each agent from its first runs and freezes it as a baseline, so a drifting agent can never become its own reference. Every run after that is scored against it with deterministic statistics. The same record always gives the same score, and anyone can recompute it. No AI judge sits in the detection path: a judge is an agent too, and drifts like one.
(Gradual drift)
A divergence channel over the agent's tool use catches behavior that wanders over weeks: a growing context, a memory that fills, an environment that shifts.
(Abrupt change)
A change-point channel catches a jump after an input, an update or an event. The two catch different real events, so every deployment runs both.
(What the record shows, measured on public agent logs)
A silent model change
Caught in 80 to 100% of trials once it changes how the agent uses its tools. The model version on every record catches the rest.
Loops and failing runs
Call rates, errors and aborts against run length are in every record. Cheap, and visible within minutes.
Injection and reward hacking
Nearly invisible to tool-frequency statistics, because they use the same tools as legitimate work. What gives them away is what a call does: a destination or a volume the agent has never used. Per-task sequence models are the next step.
Seven cases come out the way the record says they should. The eighth is the one worth finding, and only the recording makes it findable.
Rerun the past against the present.
Models change under the same name. Policies change. Nothing announces it.
Replay a recorded run against today's models and policies.
A recorded run is a hundred real cases where the right answer is already known. Replay it against what would happen today and the difference is something you can point at, instead of a complaint that arrives six weeks later. The same recording is what continuous evaluation runs on: measured against the outcome in your system of record, not against what a person happened to click. Replay runs today. Continuous evaluation is coming soon.
Stop an agent before it costs you.
A drifting, hijacked or looping agent goes into quarantine. A human decides what happens next.
Quarantine · Inline DLP · Policy blocks · Agent and MCP blocking
When the score leaves its band, Kyde cuts the agent's reach at the boundary: the run stops, the record stays, and the open work goes to a person.
Standing rules run through the same point: no payment over a threshold without approval, no customer data to an outside service, no MCP tool outside its mandate. Observe first, enforce when ready.
The blocked action stops at the policy line, not inside your systems.
What the gateway checks before an action runs.
Know who is acting.
Every worker and every agent carries a name of its own, not a shared key that four systems use.
Decide what it can do.
Rules are checked before the action executes, not written up in a report afterwards.
Control what it can see.
Sensitive fields are masked inline, before they ever reach a model.
Control how far it can go.
Spend, volume and reach held across a run, not just per call. Coming soon.
Prove what happened.
A hash-chained record written at the boundary, which your auditor recomputes without us.
Evidence the other side can check without you.
Who acted, which agent, which model, under which policy.
Every entry is hash-chained at the boundary, before anything reaches a provider, and held outside the reach of the thing being recorded. Altering one link breaks every link after it, and an auditor recomputes the chain offline, without us in the room. Your provider's log lives on their infrastructure and is read through their console. In a dispute that involves them, it is theirs, not yours.
The export is recomputed on the other side. Everything after the boundary happens without us, and nothing comes back.
Built for independent verification.
Evidence you cannot check yourself is a claim. Every part of the record is built so somebody outside this company, and outside your company, can arrive at the same answer without asking either of us.
- Hash chain
- Each entry carries the hash of the one before it. Altering a single entry breaks every link after it.
- Append-only
- Entries are written at the boundary as the action passes, and held outside the reach of the system being recorded.
- Offline recomputation
- An auditor recomputes the chain from the exported document, on their own machine, with us not in the room.
- Open-source gateway
- The gateway and the ledger are open source, so the thing writing the record can be read. github.com/kydehq/gateway →
- Ed25519 signing
- Signing each entry proves authorship rather than order. An Enterprise capability.
- Your keys
- Signing keys are yours and stay in your environment. A record we could produce on your behalf is a record we could also alter.
What this is for
All of it exists so drift is
something you can stop.
The record is the measurement. An agent that crosses this boundary leaves a history nobody can quietly revise, and that history is what a baseline is built from and what a deviation is caught against.