# KIFF

> KIFF gives each AI agent a Card: which actions it may take, how much per action and in total over a window, and what happens to a call outside those limits. KIFF decides every proposed consequential action before it runs, against the business's own state and the agent's Card. A call outside the Card waits for the owner or is refused. The owner changes or revokes the Card without changing the agent, and every decision has a signed, tamper-evident receipt.

Agents now refund, credit, book, cancel and change accounts on their own. Each action costs almost nothing, so teams ask for many more of them, and a person approving each one becomes the whole cost. Payment networks now give agents credentials capped per payment. A payment cap knows one payment. KIFF covers what it cannot see: actions that are not payments, totals over time across agents, the state of the order or account, who answers when the agent goes over, and a record the agent's vendor did not write. In one line: payment networks cap a payment; KIFF caps the agent.

## Key facts

- What a Card says: which actions the agent may take (refund an order, not cancel a subscription); the most per action; totals per window, counted as a number of actions or a sum of one parameter (for example €500 and 10 refunds a day); what happens outside it (hold for the owner, or refuse); an optional expiry. One agent holds a Card by default; a Card can also be shared by up to 20 agents drawing on one balance, and each decision still names the agent that asked. An agent holding several Cards is bound by the tightest.
- How a call is checked, three ways: (1) the MCP gateway at `mcp.kiff.dev`, KIFF holds the tool's credential, so the agent's key can only ask, and the agent cannot reach the tool around its Card; (2) kiff-guard, one hook in the agent's tool loop in your own code (Python and TypeScript, eleven verified framework adapters); (3) one call to the decision API, `POST /v1/proposals/decide`, from any code. Outcomes: `allowed`, `approval_required`, `blocked`, `invalid`.
- What "allowed" means: KIFF authorized the call. Through the gateway KIFF then forwards it to the tool; elsewhere the company's own system runs it. KIFF never moves money itself.
- Outside the Card, the owner answers: a held call reaches the owner on Needs you, by email, and as a link in the agent's chat (Claude Code). The owner approves it once, changes the Card, or rejects it. Only the owner's signed-in session can answer; a hold nobody answers is refused when it expires (10 minutes by default). An agent key can never answer an approval it asked for.
- The owner changes the Card, not the agent: raise it for a busy week, narrow it, move it to another agent or revoke it, and the next call uses the new terms. Revoking one Card withdraws only what that Card granted.
- Correct under load: concurrent calls, retries and several workers draw on one balance held centrally. A retry counts once. Two runs cannot both spend the last of a balance. If the balance cannot be read, KIFF refuses; unknown is never read as zero.
- The record: every change to a Card is attributed, every draw is on the Card's statement, and every decision has a signed, tamper-evident receipt the agent cannot write. The draw is recorded when the action is authorized, not when the caller executes it.
- Under the Card is the operational domain (a versioned `kiff.yaml`: entities, states, actions, permissions, approvals). KIFF decides every proposed consequential action against it, from the real state rather than what the caller claims, and a caller cannot approve its own request. Where an action declares `requires_authority`, that decision also draws on a card the organization issued to the acting agent. A card narrows what the domain allows; it cannot make a forbidden action legal.
- Where the Card is the final authority: wherever KIFF is on the only path to the capability, as through the gateway. An agent that can still act through a browser or a direct credential is outside it; close that path, or KIFF does not govern it.
- Shipped today: Cards with per-window limits, shared Cards and statements; the MCP gateway (remote MCP, bearer credentials); held calls with owner approvals and expiry; eleven kiff-guard adapters; Claude Code and Codex through the gateway; signed receipts; the MIT framework. Direction, not product: controls across many agents at once, a view for builders running several clients, tools that accept only calls carrying KIFF's authorization, and payment credentials created only after an `allowed` decision.
- Who it is for: businesses whose agents take consequential actions on their own money or operations (refunds, credits, payouts, plan and access changes), and the builders who deliver those agents to clients. Not sold to consumers using a personal agent; their protection belongs to the payment layer and the agent's own confirmations.
- Open source and price: the KIFF Framework (Go) and the kiff-guard SDKs are MIT and need no account. Companies pay for KIFF Cloud, the hosted runtime with owner controls, statements and signed receipts, priced on governed operations (authenticated requests KIFF answers and records), not per agent, seat or token. During early access the price is agreed with each company.
- For coding agents (Claude Code, Codex and similar): install the KIFF skill from `https://kiff.dev/skills/kiff.md`. It connects a tool through the gateway, drafts a Card for the owner to issue, and handles a held call: retry the identical call with the same `kiff_operation_id`, and never make the same change another way.
- What it is not: not an agent platform, a workflow engine, a model gateway or an app builder. It works alongside them.

## Core

- [KIFF](https://kiff.dev/): Give the agent a Card. A KIFF Card holds a set amount of authority that the agent uses up as it acts; the business gives it more or takes it back without a release or a change to the agent. The Card lives with the business (which actions, in which states, how much, until when), not in the agent’s code. The owner raises, lowers or revokes a card and the next request uses the new terms; each agent holds its own cards, so revoking a card withdraws only the authority that card granted and leaves other agents untouched; every change and decision stays on record. KIFF answers each proposed action before your system runs it. Free to build on the MIT framework; the company pays for KIFF Cloud Production.
- [KIFF for agents](https://kiff.dev/agent): The canonical machine-entry page, what KIFF does, when an agent should (and shouldn't) use it, the real decision API (POST /v1/proposals/decide; outcomes allowed/approval_required/blocked/invalid), minimal integration, current status, and links to every machine surface.
- [Why KIFF](https://kiff.dev/why): The founder's account: a Card for every AI agent, as familiar as a corporate card; why authority and credentials belong outside the agent; why agents acting on money and accounts is about to be normal; built for companies, with individuals named only as a hypothesis for later; the direction of one Card that travels across every assistant (ChatGPT, Claude, Grok and others), marked as not built yet; and why it has to be open source.
- [Whitepaper](https://kiff.dev/whitepaper): The framework's design and principles.
- [MCP walkthrough, English](https://kiff.dev/proof/videos/mcp-from-zero-en): Watch the end-to-end MCP setup, current Card limits, owner approval and a real tool call. KIFF production gateway, Stripe test mode.
- [MCP walkthrough, Français](https://kiff.dev/proof/videos/mcp-from-zero-fr): The French narrated MCP walkthrough, with current Card limits and owner approval. KIFF production gateway, Stripe test mode.
- [Customer operations, portrait](https://kiff.dev/proof/videos/customer-ops-portrait-en): A 58-second illustrated scenario for phones: connect tools, issue a Card, allow a €180 credit, hold €1,400, refuse a payment-terms change, and approve once. English narration; downloadable MP4. Fictional example, no live calls.
- [Customer operations, landscape](https://kiff.dev/proof/videos/customer-ops-landscape-en): The same 58-second illustrated scenario for presentations, led by the isometric map. An interactive version is available on /integrate.
- [Proof](https://kiff.dev/proof): A synthetic KIFF Card test run on KIFF’s production services (app.kiff.dev / api.kiff.dev) on 22 Sep 2026, with no customer data, recorded in the product: seven decisions (three allowed, four refused) with seven signed receipts, the owner raising the limit from €5,000 to €8,000 and then revoking the card. KIFF verified the decisions and what they drew from the card; "allowed" does not mean the refund executed, the company’s own system runs it. Also the agent and product demo videos (formerly /videos, which redirects here), and the runnable domain proofs, which show the state machine under a card and are not card evidence.
- [Invariants](https://kiff.dev/invariants): The behavioural guarantees the cloud runtime makes, each anchored to the test that proves it with a file and line. Generated from the test suite by a generator whose own test fails the build when the page stops matching what passes, so it cannot describe a guarantee the code stopped making. Covers apps/api only; the page states plainly that a passing test proves the property it tests and nothing else.
- [Production Launch](https://kiff.dev/on-rails): Optional: KIFF gets a company’s first agent action live with them. Count the drafts a person executes unchanged, observe the action on real traffic without refusing anything, issue the agent a card so the clear cases run and a person sees only the exceptions, control-test that path, then hand it over to the operations owner. Observing is agreed first, from the action alone; the rest is scoped from what observing shows. If almost everything needs a human, KIFF says so and the launch stops.
- [Integrate](https://kiff.dev/integrate): The developer journey, the operational domain a card narrows against, Guard's adapters for each agent framework, the coding-agent domain skill that authors a kiff.yaml, and the three-line integration.
- [Delegate](https://kiff.dev/delegate): Interactive walkthrough of a Card, run live on the page with sample agents and sample data. A delegation sentence is broken into its five parts (action, what it applies to, per-action limit, total limit, what happens otherwise), each becoming a line on the Card; the Card is given to a suggested agent, the agent draws it down, a request above a limit is refused, and the Card can be moved to another agent (keeping its balance and statement) or revoked. Ends with a gallery of example Cards for business and personal use, each with why its limits are set and where it is useful.
- [Pricing](https://kiff.dev/pricing): Free to build: the framework and Guard SDKs are MIT, with no account required. KIFF Cloud Production is what the company pays for: workspace, owner controls for every card, dashboard and statements, full history and signed receipts. It is priced on what you govern (governed operations: authenticated requests KIFF answers and records; retries, bad requests and reads are free), not per agent, seat or token. During early access there is no published price; it is agreed with each company before it commits, and extra use is tracked, not billed automatically. An optional Production Launch gets the first action live with KIFF. Start with a free 30-minute review: gabriel@kiff.dev.

- [For builders](https://kiff.dev/builders): For anyone building agents on KIFF, for clients or for their own business. Build the agent once and let the owner change its authority: KIFF is the reusable authority layer (limits, ownership, balance, revocation, evidence) that would otherwise be rebuilt for every deployment. Why supervision, not the work, limits autonomous agents; what a card is (a delegation closer to a licence than a payment card); why a hand-written limit fails under concurrency, retries, restarts and outages; and the phases of building with KIFF (integration and control testing, owner handover, then operations views once live). A clearly labelled section covers directions not built today. The walkthroughs are illustrative. Implementation scope, price and duration are agreed before work begins.

## Tutorials

- [From a refund tool to an agent with a €50 Card](https://kiff.dev/blog/from-a-refund-tool-to-a-governed-mcp-agent): An end-to-end tutorial with the external Stripe test-mode MCP adapter, Lambda hosting, paid test order, KIFF connection and Card forms, Codex configuration, downloadable Python examples, and prompts for an allowed refund, owner approval, and changed limit. Real screenshots and recorded results; explains the generated gateway domain and the limits of this integration.

## Product notes

- [An approved refund can still fail](https://kiff.dev/blog/an-approved-refund-can-still-fail): Why authorization and the tool's reported outcome are separate facts, how pending MCP calls are recovered, and how the optional Claude Code plugin brings back the owner's answer. The refund example is illustrative; accounting implementation remains separate.

## The framework (open source, MIT, Go)

- [KIFF Framework on GitHub](https://github.com/kiff/kiff): The protocol kernel, events, state, decisions, actions, approvals, audit. Embed it in your backend; useful with zero cloud. Ships a CLI to scaffold and verify domains.
- [Build a domain with the framework](https://kiff.dev/docs/framework-quickstart): Scaffold a runnable refund domain with `kiff new -scenario refund`, run it, and watch KIFF allow the good refund, hold the risky one for a human, and refuse the duplicate. Local, MIT, no account.
- [What KIFF is](https://kiff.dev/docs/what-kiff-is): Scope and non-goals.
- [How kiff-guard works](https://kiff.dev/docs/concepts): Observe vs enforce, the one-receipt rule, and the two adapter shapes.
- [Domains](https://kiff.dev/docs/domains): The reusable operational contract.
- [Decisions](https://kiff.dev/docs/decisions): The proposal-to-decision model.
- [Receipts and proof](https://kiff.dev/docs/receipts-and-proof): Tamper-evident evidence that the decision ran before the action.
- [What's real today](https://kiff.dev/docs/whats-real-today): An honest account of what ships now.

## kiff-guard (the on-ramp for existing agents)

- [kiff-guard on GitHub](https://github.com/kiff/kiff-guard): Attach to your agent's tool calls, observe what it does, then migrate the risky actions onto the framework. Python and TypeScript, MIT, with adapters for common agent frameworks.
- [Connect an agent](https://kiff.dev/docs/connect-an-agent): Three ways in: the MCP gateway for agents that call MCP tools, kiff-guard for agents in your own code (observe, then enforce against the agent's Card), or one call to the decision API from any code.
- [KIFF Plugins](https://github.com/kiff/kiff-plugins) (beta): `kiff-cards` connects Claude Code to the gateway and installs both skills below; the optional `kiff` plugin adds Card status, held-call notices, owner-answer recovery through read-only `kiff_pending`, and `/kiff`. `/plugin marketplace add kiff/kiff-plugins`, then `/plugin install kiff-cards@kiff` and optionally `/plugin install kiff@kiff`. Claude Code asks for the agent's gateway key and stores it securely. [Installation, permissions and recovery](https://kiff.dev/docs/agent-skill). MIT.
- [KIFF skill for coding agents](https://kiff.dev/skills/kiff.md) (beta): A portable SKILL.md for Claude Code, Codex and similar agents: connect an agent or remote MCP tool through KIFF, propose a Card for the owner to issue, handle held, refused and unknown results, and find the right repository or doc. The skill is guidance; the KIFF MCP gateway enforces the Card. Install guide: [kiff.dev/docs/agent-skill](https://kiff.dev/docs/agent-skill).
- [Domain skill for coding agents](https://kiff.dev/skills/kiff-domains.md): A portable SKILL.md a coding assistant (Cursor, Kiro, Codex, Claude Code, and more) installs so it authors and extends your kiff.yaml domains against the real grammar, states, actions, approvals, permissions, executors. Fetch with one curl.
- Adapter guides: [Agno](https://kiff.dev/docs/agno), [LangGraph](https://kiff.dev/docs/langgraph), [Hermes](https://kiff.dev/docs/hermes), [OpenAI Agents](https://kiff.dev/docs/openai-agents), [Google ADK](https://kiff.dev/docs/google-adk), [Pydantic AI](https://kiff.dev/docs/pydantic-ai), [Strands](https://kiff.dev/docs/strands), [Haystack](https://kiff.dev/docs/haystack), [Microsoft Agent Framework](https://kiff.dev/docs/microsoft-agent-framework), [LlamaIndex](https://kiff.dev/docs/llamaindex), [OpenClaw](https://kiff.dev/docs/openclaw).

## KIFF Cloud (hosted runtime) and Studio (the domain's rendered view)

- [KIFF Cloud](https://app.kiff.dev): The KIFF runtime, hosted, agents and services call it over HTTP to propose an action and get a decision before execution, with approvals, signed receipts, and a governance evidence view.
- [KIFF API](https://api.kiff.dev): The headless runtime contract, POST a proposal, get a decision before execution.
- [Quickstart: give an agent a Card](https://kiff.dev/docs/quickstart): Connect a remote MCP tool and an agent in KIFF Cloud, issue the agent a Card, and answer its first held call. No code.
- [Held calls and approvals](https://kiff.dev/docs/approvals): Owner answers in KIFF Cloud; the agent collects the same call. Read-only pending recovery and the optional Claude Code plugin bring back answers given in time, even when read late. Approval and the tool's reported outcome are separate facts; errors, unknown outcomes and older unrecorded outcomes do not establish success. An unanswered hold is refused after its expiry (10 minutes by default).
- [MCP gateway](https://kiff.dev/docs/mcp-gateway): Connect an agent supporting remote MCP over HTTP to `mcp.kiff.dev`, connect remote MCP tools to KIFF, and check each call against the agent's Card before forwarding. Production smoke-tested with Claude Code and Codex using a temporary test tool. Set up in KIFF Cloud (Connected tools, then the agent's Tools tab) or with the gateway API; remote MCP only, bearer credentials only, no OAuth or arbitrary HTTP APIs.
- [Tools that check KIFF](https://kiff.dev/docs/tool-permits): Choose who holds a connected tool's key: `sealed` (KIFF, encrypted), `verify` (the tool checks a short-lived Ed25519 execution permit KIFF signs for each allowed call, with the open-source verifier in `kiff-guard[verifier]`) or `relay` (a relay you run holds the key). The verifier runs each operation at most once and never resends a call whose answer was lost.
- [Govern](https://kiff.dev/docs/govern): Decisions, receipts, approvals, and verifiability.
- [KIFF Cards](https://kiff.dev/docs/kiff-cards): The instrument an organization issues to one named agent: the actions it may take, the entity states it may take them in, a ceiling counted as `count` or `sum(<parameter>)` over a window, and an optional expiry. Required only for actions the domain declares `requires_authority`, where absence is refused with `no_mandate_issued` and any proposal that would draw on a card needs an API key issued for its holder (`key_not_bound_to_agent`, `actor_not_key_holder`). Draws are recorded at authorization, not execution; issuing and revoking are management actions a runtime key cannot perform.

## Legal and trust

- [Security](https://kiff.dev/security)
- [Privacy](https://kiff.dev/privacy)
- [Terms](https://kiff.dev/terms)
- [Data Processing Addendum](https://kiff.dev/legal/dpa)
- [EU AI Act](https://kiff.dev/ai-act)

## Optional

- [llms-full.txt](https://kiff.dev/llms-full.txt): The full text of the docs and whitepaper concatenated into one file, for single-fetch ingestion.

_Last updated: 2026-10-08._