An approved refund can still fail
KIFF records the tool’s response beside its authorization decision and brings pending approvals back into the agent’s session through MCP.
Writing
Notes from building a governance runtime
Mostly what broke, and what we changed because of it.
2026
From a refund tool to an agent with a €50 Card
Build a Stripe test-mode MCP tool, connect it to KIFF, and reproduce an allowed refund, an owner approval, and a limit change with Codex.
Outside the card, the work comes home
A KIFF Card now holds an action that falls outside it for its owner, who can approve it once, change the card or reject it; we tested all three on production.
Putting KIFF between an agent and its tools
The KIFF MCP gateway checks every tool call an agent makes against its Card. Since 2 October it is set up from the dashboard, held calls are emailed to the owner, and a hold nobody answers is refused.
We gave a real agent a €50 card and asked it for refunds
A live Agno agent on Bedrock, governed by a KIFF Card through kiff-guard on production: what it was allowed, what it was refused, and what the card recorded.
Our injection defence held 100% of the attacks and 100% of the work
We gated an agent's public writes on whether the run had touched untrusted content. It stopped every attack and every legitimate post too, because it was watching the first link of a three-link chain.
The test passed. The approval did not exist.
Building a control that holds an agent's action for a human, we wrote the same bug four times: something that read as present and was not. Here is each one.