Outside the card, the work comes home
A KIFF Card now holds an action that falls outside it for its owner, who can approve it once, change the card or reject it; we tested all three on production.
Tagged “security”
4 posts
2026
We gave a real agent a €50 card and asked it for refunds
A live Agno agent on Bedrock, governed by a KIFF Card through kiff-guard on production: what it was allowed, what it was refused, and what the card recorded.
Our injection defence held 100% of the attacks and 100% of the work
We gated an agent's public writes on whether the run had touched untrusted content. It stopped every attack and every legitimate post too, because it was watching the first link of a three-link chain.
The test passed. The approval did not exist.
Building a control that holds an agent's action for a human, we wrote the same bug four times: something that read as present and was not. Here is each one.