Kastra Puts a Bouncer Between Your Coding Agent and Production
The week frontier models escaped a sandbox through a package proxy, a small team shipped the least glamorous and most obviously necessary product in the agent stack: a policy engine that sits in front of tool calls. Kastra intercepts what Claude Code, Cursor, Codex and OpenClaw ask to do, evaluates it against deterministic rules, and decides before the call executes. It hit 298 upvotes on Product Hunt and a Show HN thread on the same day.
The design point is the word deterministic. Every coding agent already has a permission system, and every one of them is a prompt-shaped negotiation you can talk your way through. Kastra's check happens after the model has decided to act and before the outside world changes, and the rule that runs is code, not vibes. Drop a database write, block a curl to an unknown host, require approval for anything touching a prod credential. The model does not get a vote.
Why this shape and not sandboxing is the interesting bit. Sandboxing works when the agent lives in a box you control. Coding agents do not. They run on your laptop, with your SSH keys, your cloud CLI already authenticated, your kubeconfig sitting there. You cannot air-gap that without destroying the reason you hired the agent. So the enforcement point moves from the perimeter to the individual action, which is the same architectural move that killed network-perimeter security fifteen years ago in favor of per-request authorization.
Runtime authorization is going to be a category, not a product. Cloudflare shipped temporary accounts for agents, Runlayer raised a Series A on the gateway version, AgentKey went at the credential layer. Kastra is the local-first take, aimed at the developer whose agent already has more access than any junior engineer would get on day one. That gap between what we grant agents and what we would grant a person is the actual security problem of this year, and nobody has closed it.
Show HN discussion: https://news.ycombinator.com/item?id=48847526
← Back to all articles
The design point is the word deterministic. Every coding agent already has a permission system, and every one of them is a prompt-shaped negotiation you can talk your way through. Kastra's check happens after the model has decided to act and before the outside world changes, and the rule that runs is code, not vibes. Drop a database write, block a curl to an unknown host, require approval for anything touching a prod credential. The model does not get a vote.
Why this shape and not sandboxing is the interesting bit. Sandboxing works when the agent lives in a box you control. Coding agents do not. They run on your laptop, with your SSH keys, your cloud CLI already authenticated, your kubeconfig sitting there. You cannot air-gap that without destroying the reason you hired the agent. So the enforcement point moves from the perimeter to the individual action, which is the same architectural move that killed network-perimeter security fifteen years ago in favor of per-request authorization.
Runtime authorization is going to be a category, not a product. Cloudflare shipped temporary accounts for agents, Runlayer raised a Series A on the gateway version, AgentKey went at the credential layer. Kastra is the local-first take, aimed at the developer whose agent already has more access than any junior engineer would get on day one. That gap between what we grant agents and what we would grant a person is the actual security problem of this year, and nobody has closed it.
Show HN discussion: https://news.ycombinator.com/item?id=48847526
Comments