Kyvvu

A behavioral firewall for AI agents

Your organization has rules. About customer privacy, data handling, decision transparency, escalation, and what your agents are and aren't allowed to do. When you deploy AI agents, those rules have to be enforced at runtime — not hoped for in a prompt, not checked after the fact in a log.

Kyvvu sits between your agents and everything they touch. Every atomic behavior an agent attempts — every LLM call, every tool invocation, every write to a system of record — is intercepted, evaluated against your policies in the context of the full execution path so far, and either allowed, blocked, or routed to human approval. In under a millisecond per policy evaluation.

Think of it as Cloudflare for agents: the same architectural pattern — a thin, always-on control layer that sees every request and enforces your rules — applied to non-deterministic AI systems instead of HTTP traffic.

See it in action

Read the docs    Open the dashboard

How it fits together

Two audiences, one runtime. On the left, developers integrate their agent via an SDK (Python, LangChain, LangGraph), a proxy (Claude Code), or a connector (Microsoft Copilot Studio, MS Agent SDK). On the right, CISO and legal teams define governance rules in plain language. The Kyvvu Engine mediates between the two: it consumes agent behaviors, evaluates them against the policy library, and enforces the decision back on the agent — allow, block, or stop.

How it works

Wrap your agent's actions with the Kyvvu SDK. Each step is intercepted by the policy engine before it executes:

from kyvvu import Kyvvu, KyvvuBlockedError, RiskClassification, StepType, Verb

kv = Kyvvu(api_url="https://platform.kyvvu.com", api_key="KvKey-...")
kv.register_agent(
    agent_key="support-agent",
    risk_classification=RiskClassification.HIGH,
    name="Customer Support Agent",
    declared_tools=["call_llm", "lookup_customer", "send_email"],
)

@kv.step(StepType.step_model, Verb.POST)
def call_llm(prompt: str) -> str:
    return openai.chat(prompt)

@kv.step(StepType.step_resource, Verb.GET)
def lookup_customer(customer_id: str) -> dict:
    return crm.get(customer_id)

@kv.step(StepType.step_exec)
def send_email(to: str, body: str) -> str:
    # Blocked by policy unless a human approval gate precedes it
    return smtp.send(to, body)

Policies are defined in version-controlled YAML manifests — browse the open-source library — and evaluated in-process by the Kyvvu Engine. No network call per step, sub-millisecond evaluation, path-dependent enforcement.

Path-dependent enforcement

Most governance tools evaluate each action in isolation. Kyvvu evaluates actions in context — what the agent did earlier in the task determines what it's allowed to do next.

The exfiltration guard uses five layers of defense, three of which are path-dependent. A stateless per-call policy can't do this — it doesn't know what happened before. View the manifest source.

Three outcomes, one layer

• Runtime enforcement — Policies on paths, evaluated in sub-millisecond time before the next behavior executes. Allow, block, or escalate — deterministically.
• Structured observability — Every intercepted behavior and every enforcement decision becomes a hash-chained, tamper-evident log entry. Audit-ready by construction.
• Incident escalation — When a policy is violated or human approval is required, Kyvvu generates a structured incident with the full execution path as context, routed to your existing workflows.

Works with the frameworks you already use

Kyvvu is framework-agnostic. We have production integrations for:

• Core Python agents (SDK)
• LangChain and LangGraph (callback handlers)
• Microsoft Copilot Studio and MS Agent SDK (connector)
• Claude Code (local proxy)
• Any other framework — via our locally running kyvvu-engine

EU AI Act compliance, from the bottom up

Most compliance tooling is top-down: policies written in documents, referenced in audits, with no mechanical link to what agents actually do. Kyvvu is the opposite. Because every atomic behavior is intercepted and logged, and every policy is enforced at the step level, you get the runtime evidence Articles 9, 12, 14, and 15 of the AI Act actually require — continuous risk management, automatic logging, meaningful human oversight, and accuracy/robustness monitoring.

One unified vocabulary (atomic behaviors), clear policies, demonstrable enforcement — across every agent you deploy.

See how policies on paths map to the AI Act →

Where we are

Kyvvu is deployed in enterprise environments across regulated industries in the Netherlands — financial services, insurance, healthcare — inspecting agent behavior in production. Our approach to runtime governance is documented in our arXiv paper Runtime Governance for AI Agents: Policies on Paths, and has been discussed in a joint perspective with a leading AI conformity and certification partner.

How to engage

Kyvvu is delivered through a small set of authorized partners — tier-1 consultancies and AI governance specialists who handle integration, policy design, and ongoing support. We work alongside them on every deployment.

Technical questions, integration details, and research: maurits@kyvvu.com

About Kyvvu

Kyvvu is an enterprise AI governance company founded by Maurits Kaptein and Jeroen Ghijsen, based in the Netherlands. We build runtime infrastructure for governing autonomous AI agents in regulated industries.

Learn more about us or see open positions.