General deck · v1.0 · updated 2026-10-02, press ⌘P / Ctrl+P to save as PDF.

A card for every agent.

Agents now refund, book, buy and cancel on their own. The owner decides once what each one may do. KIFF checks every action against it before it runs.

the ownerIssues a Card.Which actions, how much each, how many a day, and what happens outside it.
then
KIFFChecks every call.Inside the Card it goes through. Outside, it waits for the owner or is refused.

The agent keeps doing the work. The owner keeps the authority.

Agents are starting to act on money.

InterfacesPersonal and business agents now complete tasks end to end.Instinct raised $1B at a $10B valuation in September 2026 for an agent that buys, books and cancels.
PaymentsThe rails give agents their own credentials.Stripe's agent tokens are tied to one merchant, time-limited, capped and revocable.
The gapA payment cap knows one payment.It doesn't know the agent's other actions, its total this week, or the state of the order.

The rails cap a payment. KIFF caps the agent.

not only paymentsEvery consequential actionRefunds, cancellations, bookings, plan and access changes.
over timeTotals per windowTen refunds a day, shared by two agents, across every merchant.
when nobody is watchingThe owner answersOutside the Card, the call waits for the owner, and is refused if nobody answers.

Cheap actions multiply the decisions.

ActionsAn agent's action costs almost nothing.So teams ask it to do far more of them.
VolumeThe number of consequential actions grows.Refunds, credits, access changes, deploys.
ApprovalA person approving each one becomes the whole cost.Supervision grows with the work, and the saving stops there.

Three answers today. None of them scale.

approve everythingA person clicks each oneSafe, and the agent saves typing, not work.
hand over the keyThe agent can do anythingFast, and nothing bounds how much.
write the limit inA prompt, a config, a functionNobody on the business side can read it, and every change is a deploy.

What a Card says.

ActionsWhich actions this agent may take.Refund an order. Not cancel a subscription.
How muchThe most per action, and totals per window.€50 a refund, €500 and 10 refunds a day.
Outside itHold it for the owner, or refuse it.A held call waits a set time, then it is refused.
Who holds itOne agent, or several sharing one balance.Revoke it, and only that authority stops.

Correct, and still refused.

Illustrative: Refund Card, one day€1,100 ceiling
€42 drawn€990 drawn€68 left
Next refund: €88. Valid order. Permitted agent. €20 over the ceiling. KIFF holds it before anything runs.

An alert tomorrow would tell you what happened. The Card decides what may happen now.

Outside the Card, the owner answers.

HeldNothing reaches the tool.The agent is told the call is waiting, with a link.
ReachedNeeds you, an email, and the agent's chat.In Claude Code, the chat offers to open the owner's page.
AnsweredApprove once, change the Card, or reject.Only the owner's signed-in session answers. No answer in time: refused.

See it run.

recorded, not mocked1.5 minreal model · real gateway · Stripe test modeWatch the demo →
what happens
  • A support operator asks the agent for a €24 refund. Inside its Card: it goes through.
  • An €86 refund is over the €50 limit. KIFF holds it; nothing reaches Stripe.
  • The owner approves it in KIFF.
  • The agent, waiting in the same conversation, finishes the refund once.

A limit you write yourself breaks under load.

Two at onceTwo runs both read €1,000 left.KIFF locks draws per card: the second is refused.
RetryA timeout retries the same refund.KIFF keys the call: it counts once, and is sent once.
ScaleThe agent runs as three workers, or two agents share a Card.One balance, held centrally: no fresh allowance.
OutageThe balance cannot be read.KIFF refuses. Unknown is never read as zero.

“Who allowed this?” has an answer.

IssuedWho gave this agent which authority, and when.Every change to the Card is attributed.
DrawnWhat each authorization used.The statement shows the balance and how it moved.
Held or refusedWhat was stopped, and why.Each decision has a signed, tamper-evident receipt. The agent can write neither.

Three ways to connect an agent.

calls MCP toolsThe KIFF gatewayPoint the agent at mcp.kiff.dev. KIFF holds the tool's credential. No code.
runs in your codekiff-guardOne hook in the agent's tool loop. Eleven frameworks verified.
any codeThe decision APIOne call before the action. Your code still runs it.

Where the Card is the final authority.

TodayWherever KIFF is on the only path.Through the gateway, KIFF holds the credential: the agent can't reach the tool around its Card.
Not by itselfAn agent that can still act through a browser or a direct credential.Close that path, or KIFF doesn't govern it. We say so.
NextTools that verify KIFF, and payments that follow the Card.Direction, not product yet.

Give one agent a Card.

start free10 minDeveloper plan · no codeOpen the quickstart →
or bring us one action