What’s real today vs planned

These docs describe what KIFF does, not what it might do. This page is the explicit line between the two, so you never build on a claim the product can’t back yet. If something isn’t here as shipped, treat it as not shipped.

Real today

  • The decision. KIFF evaluates a proposed action against an entity’s state and your policy and returns allowed, blocked, or approval_required: before the action runs. A malformed or misconfigured request is invalid (a client error to fix, not a governance decision, and not a governed operation). See Decisions.
  • Read an entity’s lifecycle. The recorded proposals, approvals, and executions for an entity can be read back as one chronological, tenant-scoped, read-only view. See Decisions.
  • Observe mode, zero config. Attach the guard to an agent you already run, with no account and no config, and get a real audit trail plus a derived starter policy. See Connect an agent.
  • Enforce mode through the guard. Switch the guard to enforce, point it at a tenant, and KIFF’s decision is acted on before each tool runs, failing closed on error. See How the guard works.
  • Shipped framework adapters. Eleven kiff-guard adapters are verified against the real framework and pass the conformance suite. The sidebar badges say so per framework.
  • KIFF Cards, with three honest limits. You can issue a card to a named agent, read its statement, change its ceiling and revoke it. The three things to know before building on it:
    • A card constrains; it never confers. It narrows what the domain and its permissions already allow and caps how much of it happens. It cannot grant an action the domain does not have, or legalise one in a state it forbids.
    • It is only required where the action says so. An action that declares requires_authority is refused with no_mandate_issued when nothing has been issued to the proposing actor. Every other action is decided without a card, exactly as before.
    • The key has to be issued for the holder. Wherever a proposal would draw on a card, an API key not issued for the proposing agent is refused, so one agent cannot name another and spend its card.
    • A draw is recorded when the action is authorized, not when it executes. KIFF decides; your system runs the action afterwards and reports nothing back, so an authorization you chose not to run still counts against the window.

See KIFF Cards. - MCP gateway for remote tools. An agent can connect to mcp.kiff.dev; the account owner connects a remote MCP server to KIFF, and the gateway checks the agent’s Card before forwarding each tool call. Claude Code and Codex passed production smoke tests with a temporary tool: allowed calls reached it, held calls waited for owner approval, and retries of an approved call reached it once. This tested the gateway path, not a customer transaction or every MCP client. See Use the KIFF MCP gateway. - Held calls and approvals. A call outside its Card can be held for the owner: listed on Needs you, emailed once to the owner, and, for Claude Code 2.1.287 or later, offered as a link in the agent’s chat. Only the owner’s signed-in session answers. Each Card sets how long a hold waits (10 minutes by default); an unanswered hold is refused. See Held calls and approvals. - Personal and company accounts. An account is “for me” (Cards, agents, tools, Needs you, Activity) or “for a company” (the full workspace with domains, contracts and API keys). It changes what is shown, not what KIFF decides. - Signed, tamper-evident receipts. Every decision records one signed receipt of what was authorized, before execution. See Receipts & proof packs. - Govern + proof packs. For company accounts, an evidence view per action in a domain on your real traffic, exportable as a proof pack from the same evidence object, with honest empty / not-yet-recorded states. See Govern. - Per-domain observe → enforce posture. Each domain carries its own governance posture, flippable from its home page, one domain can enforce while another observes, and the moment of the flip is recorded. Changing enforcement is a management action. See Govern. - Many domains in one workspace. Run more than one operational domain side by side. The all-domains view shows each domain’s posture, runtime freshness, recent activity, and its one next action; an in-progress domain appears as a draft while the others keep operating. See Domains.

Not shipped, do not assume

  • Production anchoring. Receipts are signed and tamper-evident, and can be anchored to an external trail, but the production form of public anchoring is not shipped. The honest claim is signed, tamper-evident, verifiable, nothing stronger.
  • Reviewer attribution as a guarantee. The full linkage between an approval and the specific control decision is limited; where it isn’t recorded, the evidence says “not yet recorded” rather than inventing it. Don’t rely on reviewer-attribution claims.
  • Compliance certification. KIFF produces evidence that’s useful in a compliance conversation, but it is not a certification and does not assert legal sufficiency for any regime.
  • KIFF as the agent or business operator. KIFF does not run your agent or perform the connected tool’s business operation. In direct API integrations, your runtime executes after an allowed decision. Through the MCP gateway, KIFF stores connected remote MCP bearer credentials encrypted and forwards calls after an allowed decision; the remote tool performs the operation. A connection in verify or relay mode gives KIFF no key: the tool, or a relay you run, checks a permit KIFF signs for each allowed call (Tools that check KIFF). OAuth and arbitrary HTTP APIs are not supported by the gateway yet.

How we keep these docs honest

Two rules govern this page and the rest of the docs:

  1. Copy never outruns the artifact. A capability is described as real only if it’s shipped and verifiable. If it isn’t, it lives in the “not shipped” list above until it is.
  2. No demo data presented as real. Screenshots and examples in these docs are either clearly labelled as examples or drawn from a clean, safe tenant, never synthetic data dressed up as production evidence.

If you find a claim in these docs that contradicts this page, this page wins, and it’s a bug in the other page. Tell us.

Next