Blog
Blog
Writing from the people who build Kirto: where control over an agent's calls lives, what reaches the model, and how the processes agents work inside are run and replayed.
The agent control plane
What AI agents do to an enterprise's execution paths, why the vendors on those paths cannot be the neutral control over them, and what the agent control plane is.
The agent control plane · Part 1Why AI increases fragmentationAI adds execution paths to the enterprise faster than it retires them. Each new model, agent and protocol joins the systems already running, and governance that lives in a design-time model cannot see what an agent does at runtime.7 min readAbout FlowThe agent control plane · Part 2The control plane cannot be built by the platform it governsA control plane for agents across vendors has to sit outside every vendor's platform, and the companies selling orchestration, durable execution and agent frameworks earn their revenue inside one. Kirto splits the job: Gate holds the request path for any vendor's agents, Flow runs the processes agents work inside, and both write records a third party can check.9 min readAbout KirtoThe agent control plane · Part 3What the agent control plane isThe agent control plane observes, governs and proves every AI agent, across every vendor. It watches each agent's calls from outside the agent's loop, runs the processes agents work inside, and leaves records a third party can check.8 min readAbout Kirto
Where control lives
Six kinds of product sit between an application and a model, and each arrived carrying its first buyer's concerns. One post per position, one request walked past each of them, and what that position can do to it.
Where control lives · Part 1Where AI governance came fromBy 2 August 2026 the EU had deferred every AI Act obligation shaped like model approval, and left standing the one discharged while the system is in use. AI governance was built for the first kind: an inventory, a validation, documentation, a gate before deployment.7 min readAbout GateWhere control lives · Part 2Policy, enforcement and evidenceIn most AI programmes nothing on the request path enforces the policy while the call is in flight. Policy decides what should be true. Evidence shows afterwards that it was.4 min readAbout GateWhere control lives · Part 3Who is on the request pathSix kinds of product sit on the path between your application and a model. This series takes them one at a time and asks each what it can do while it holds the connection, and whose record it keeps.4 min readAbout GateWhere control lives · Part 4Buying models through a marketplaceA model marketplace sits where the provider sits: it holds the prompt, sets the retention and keeps the record of each call. Its own pages say where prompts go and how long they stay, and the record stays with the marketplace.4 min readAbout GateWhere control lives · Part 5Proxies and the unified APIOne API for every provider is a good trade until somebody asks what the provider actually received. A proxy that parses your request into its own shape and writes it back cannot answer, because what survives is whatever that shape knew about the week it was written.6 min readAbout GateWhere control lives · Part 6Response cachingA response cache in front of the model saves the whole call, including the part where something decided about it. Caching belongs where the model's own cache is, and a gateway earns the provider's discount by leaving the bytes alone.6 min readAbout GateWhere control lives · Part 7API gateways with AI pluginsKeep the API gateway you already run: its AI plugin covers keys and a spend cap on the model route. Its vocabulary is routes and headers, so every plugin that has to read a body ends in a call out to something that can.5 min readAbout GateWhere control lives · Part 8The cloud's own AI servicesBedrock Guardrails, Azure's API Management and Google's Model Armor are excellent inside the account that runs them. The record they keep lands in that account too, under its IAM, which decides what a verifier outside the account can establish.4 min readAbout GateWhere control lives · Part 9Calling a detectorA gateway can call any detector, and what comes back is a verdict about the string it handed over. Presidio, Lakera, Prisma AIRS, Guardrails AI and NeMo are all called this way. Deciding on the verdict is still the job of whatever holds the connection.4 min readAbout GateWhere control lives · Part 10Governance platformsA governance platform cannot produce evidence of a call it did not witness. The runtime that witnessed it has to hand over a record the platform can check without trusting the runtime. Credo AI, Holistic AI, IBM's watsonx.governance and OneTrust own the policy document and the evidence binder.4 min readAbout GateWhere control lives · Part 11Comparing the six positionsThree questions can be asked of any vendor on the AI request path, and each of its six positions answers them differently, Gate included. Ten posts, six positions, one question each, on one figure.4 min readAbout Gate
What reaches the model
A prompt is assembled at runtime out of a conversation, a record lookup and a tool result. What arrives in it, who wrote each part, and what a detector can and cannot tell you about any of it.
What reaches the model · Part 1The tool result is the channelPrompt injection reaches an agent through anything it reads, from an attacker who is not the user. Direct injection comes from the user turn, indirect injection from a tool result: mail, a document, a web page. Gate reads both.5 min readAbout GateWhat reaches the model · Part 2Nine ways to phrase an overrideAn injection is written in one of nine pattern families, and a classifier trained on some of them misses the others. A field guide, with one fresh example of each.6 min readAbout GateWhat reaches the model · Part 3Injection, jailbreak, harmfulInjection, jailbreak and harmful requests are three classes of text, and a control built for one does little against the others. A classifier trained on one class fires on another, and one MultiJail prompt shows how.5 min readAbout GateWhat reaches the model · Part 4Safety is measured in EnglishModels give unsafe answers more often in low-resource languages, because alignment data is English. The guards built to stop them share the same defect from the same root.4 min readAbout GateWhat reaches the model · Part 5Classifier or judgeA classifier and a judge fail at different things, so the choice depends on what the policy can be written as. A classifier learns one question from a training set. A judge reads the policy in prose and decides on exactly what the attacker sent.3 min readAbout GateWhat reaches the model · Part 6An evaluation set in a language with noneNo public Arabic prompt-injection set exists, so recall on Arabic attacks is unmeasured. Gate is building one with parallel pairs so the verdict can be compared across languages, hard negatives that outnumber attacks, and an origin tag on every row.6 min readAbout Gate
Governance in practice
One written control at a time, from the obligation as an auditor states it to the rule that discharges it on a live request.
Governance in practice · Part 1Personal data in a promptA code review cannot list the personal data that leaves the company, because a prompt is assembled at runtime. It is built from a conversation, a record lookup and a tool result, so the request itself is where the question has an answer.5 min readAbout GateGovernance in practice · Part 2Every operator breaks a tool callA redaction operator is chosen per rule, and the choice trades what the model can work with against what a tool downstream can work with. Realism is where the trade breaks.5 min readAbout GateGovernance in practice · Part 3Forrester's six AEGIS domains, and what closes eachForrester's AEGIS names six domains of guardrail for agentic AI. Which of them close while one process holds the connection, and what closes the rest of each.11 min readAbout Gate
Measured, not asserted
How the numbers on this site are produced: what the harness runs, what a measurement has to carry before it counts, and the results that went the wrong way.
Measured, not asserted · Part 1Why the number comes from the binaryA model card reports precision on the checkpoint, and what enforces is that checkpoint behind a tokenizer, a window scheme, a decoder and a threshold. One rule about where a word ends, in the last of those, took a score from 0.57 to 1.00 with the model byte for byte unchanged.5 min readAbout GateMeasured, not asserted · Part 2Read invariance with recall in the other handSome metrics reach their best value as a detector fires less, so a detector that answers nothing scores perfectly on them. Invariance is one. So is a false-positive rate, an agreement score, and a benchmark holding no positive cases. Each is read beside the number that breaks the silence.4 min readAbout Gate
Executing the standard
How Flow runs BPMN, CMMN, DMN and Arazzo as written, and the agent features that turned out to need no new format because the standards already had them.
Executing the standard · Part 1Orchestration and choreography in one modelOrchestration gives one participant the global view, and choreography gives it to nobody. A CMMN case runs choreographed plan items inside one auditable case model, and it can dispatch an orchestrated BPMN process as one of its tasks.5 min readAbout FlowExecuting the standard · Part 4One discipline, two standards bodiesBPMN, CMMN and DMN come from the OMG, and Arazzo comes from the OpenAPI Initiative, a body with no relationship to the OMG. Kirto Flow executes both the same way, because the discipline is executing the real spec instead of inventing one, whichever body wrote it.5 min readAbout Flow