# Kirto

> The agent control plane. Observe, govern and prove every AI agent, across every vendor.

## Platform

- [Secure and govern every AI call, inline.](https://kirto.com/platform/gate): AI security and governance for every model, MCP tool and agent: keys decide who may call what, detectors inspect each call before it leaves, and every decision is signed into a record a third party can verify.
- [Where a request goes is decided per call, and every loss is refused or counted.](https://kirto.com/platform/gate/routing): A request names an alias, and what serves it is decided per call. Gate passes it through byte for byte when a provider speaks its dialect, translates only when none does, refuses a translation that would drop a capability the request uses, and counts every retry, failover and pool pick.
- [Six detector types, and any checkpoint on the Hub.](https://kirto.com/platform/gate/detectors): A model card describes a checkpoint. Enforcement runs that checkpoint behind a tokenizer, a window scheme, a decoder and a threshold, so Gate scores the whole path with the binary that enforces it, pins any checkpoint to a commit, and runs the graph where the hardware is.
- [What you can prove, and what you can start from.](https://kirto.com/platform/gate/evidence): Every decision Gate makes is signed by the node that made it and chained to the one before, and the check runs on a machine that trusts neither. A control pack is one regime's rules, each citing the article it was read from, copied into your configuration.
- [The provider's own ledger checks yours.](https://kirto.com/platform/gate/coverage): Gate meters every request from what the provider reported on the wire, and that ledger cannot see its own blind spots. A second ledger from the provider's admin usage API, judged per day and per token class, is the check on it.
- [What it stops, and where that stops.](https://kirto.com/platform/gate/threats): Eleven threats, grouped by where the text arrives, each with the asset, who writes it, the control and its limit. Then the eleven things Gate does not defend against, checked by the build against the threat model that ships with the binary.
- [Every AI gateway routes. Gate decides, and proves what it decided.](https://kirto.com/platform/gate/compare): Six kinds of product sit between your application and a model. Which moments of one request each is present for, when to use one instead of Gate, and eight questions that separate them.
- [Run agents inside a process you can replay.](https://kirto.com/platform/flow): Adaptive process orchestration: BPMN, CMMN and DMN run as written, an AI agent is one step inside them, and every step is recorded, so any run replays against the process definition that authorised it.

## Solutions

- [User turns, system prompts and tool results are all inspected.](https://kirto.com/solutions/prompt-injection): Instructions reach an assistant in the user turn and inside whatever its tools fetched. Gate reads both on the same pass.
- [83 kinds of identifier, found before the request leaves.](https://kirto.com/solutions/personal-data): Card numbers, national identifiers and keys are found in the request and rewritten on the same bytes before the provider sees them. The offset that finds a value is the offset that rewrites it.
- [Agents and tools](https://kirto.com/solutions/agents): Gate checks each call an agent makes: the model call, the MCP tool call and the message to a peer agent, under one set of keys, rules and records. Flow decides which step of the process the agent is in, and records the run so it replays.
- [A profile picks the guard your language needs.](https://kirto.com/solutions/language): Guard models are measured in English. The guard that suits English flags 80.2% of ordinary Arabic customer turns, the one that fixes Arabic costs English F1, and a profile chooses which one inspects its traffic.
- [Model risk (SR 11-7 and SR 26-2)](https://kirto.com/solutions/model-risk): What a model-risk reviewer asks of a model in production, and how a Flow replay and the Gate record answer each ask. SR 26-2 replaced SR 11-7 in April 2026 and leaves agentic AI to the bank's own governance.
- [Financial services](https://kirto.com/solutions/financial-services): Gate holds an agent's calls to SAMA's cloud rules and the PDPL at the call. Flow keeps each lending or fraud decision as a case that replays against the definition that made it.

## Docs

- [Gate documentation](https://kirto.com/docs/gate): Deploy, configure and operate Kirto Gate.
- [Flow documentation](https://kirto.com/docs/flow): Model, run and replay processes with Kirto Flow: BPMN, CMMN and DMN engines, AI agents as process steps, and the replay that checks a case's record.

## Company

- [Kirto builds the agent control plane](https://kirto.com/about): Kirto LLC is a software company in Riyadh. It makes Gate and Flow, two self-hosted products that observe, govern and prove what AI agents do, inside the networks of the organisations that run them.
- [Licensing](https://kirto.com/licensing): Gate and Flow are under the Business Source License 1.1: free to evaluate, a commercial licence for production, and MPL 2.0 for every version after four years.
- [Privacy notice](https://kirto.com/privacy): What this site collects (nothing, beyond what your browser sends to load it), what happens to an email you send us, how long we keep it, and your rights under the PDPL.
- [Trust Center](https://kirto.com/trust): How Kirto is built and run, how to report a vulnerability, and what happens after you do.
- [Request a demo](https://kirto.com/demo): See Gate and Flow on your own traffic and processes, or talk through deployment and licensing.
- [Research](https://kirto.com/research): How Kirto measures the models it ships and the ones it rejects, on the languages a deployment actually carries.
- [Blog](https://kirto.com/blog): Writing from the people who build Kirto: where control over an agent's calls lives, what reaches the model, and how the processes agents work inside are run and replayed.

## Research

- [Arabic NER corpora put the clitic inside the name](https://kirto.com/research/arabic-names-and-the-clitic): Two multilingual NER models tag ومحمد as a person, clitic included, because ANERcorp does. Half of every clitic-prefixed name in a Gulf chat set is returned one letter too long, which is the boundary a corpus wants and the wrong one for a redactor.
- [Guard models are reported in English](https://kirto.com/research/guard-models-and-language): Prompt-injection classifiers publish their precision and recall on English sets. Measured on the same sentences in ten languages, one widely deployed model flags 80% of ordinary Arabic customer turns as an attack, and the cause is the tokenizer vocabulary.

## Blog

- [Forrester's six AEGIS domains, and what closes each](https://kirto.com/blog/forresters-aegis-six-domains): Forrester's AEGIS names six domains of guardrail for agentic AI. Which of them close while one process holds the connection, and what closes the rest of each.
- [Read invariance with recall in the other hand](https://kirto.com/blog/read-invariance-with-recall-in-the-other-hand): Some metrics reach their best value as a detector fires less, so a detector that answers nothing scores perfectly on them. Invariance is one. So is a false-positive rate, an agreement score, and a benchmark holding no positive cases. Each is read beside the number that breaks the silence.
- [An evaluation set in a language with none](https://kirto.com/blog/an-evaluation-set-in-a-language-with-none): No public Arabic prompt-injection set exists, so recall on Arabic attacks is unmeasured. Gate is building one with parallel pairs so the verdict can be compared across languages, hard negatives that outnumber attacks, and an origin tag on every row.
- [Classifier or judge](https://kirto.com/blog/classifier-or-judge): A classifier and a judge fail at different things, so the choice depends on what the policy can be written as. A classifier learns one question from a training set. A judge reads the policy in prose and decides on exactly what the attacker sent.
- [Injection, jailbreak, harmful](https://kirto.com/blog/injection-jailbreak-harmful): Injection, jailbreak and harmful requests are three classes of text, and a control built for one does little against the others. A classifier trained on one class fires on another, and one MultiJail prompt shows how.
- [Safety is measured in English](https://kirto.com/blog/safety-is-measured-in-english): Models give unsafe answers more often in low-resource languages, because alignment data is English. The guards built to stop them share the same defect from the same root.
- [Why the number comes from the binary](https://kirto.com/blog/why-the-number-comes-from-the-binary): A model card reports precision on the checkpoint, and what enforces is that checkpoint behind a tokenizer, a window scheme, a decoder and a threshold. One rule about where a word ends, in the last of those, took a score from 0.57 to 1.00 with the model byte for byte unchanged.
- [Every operator breaks a tool call](https://kirto.com/blog/every-operator-breaks-a-tool-call): A redaction operator is chosen per rule, and the choice trades what the model can work with against what a tool downstream can work with. Realism is where the trade breaks.
- [Nine ways to phrase an override](https://kirto.com/blog/nine-ways-to-phrase-an-override): An injection is written in one of nine pattern families, and a classifier trained on some of them misses the others. A field guide, with one fresh example of each.
- [The tool result is the channel](https://kirto.com/blog/the-tool-result-is-the-channel): Prompt injection reaches an agent through anything it reads, from an attacker who is not the user. Direct injection comes from the user turn, indirect injection from a tool result: mail, a document, a web page. Gate reads both.
- [API gateways with AI plugins](https://kirto.com/blog/api-gateways-with-ai-plugins): Keep the API gateway you already run: its AI plugin covers keys and a spend cap on the model route. Its vocabulary is routes and headers, so every plugin that has to read a body ends in a call out to something that can.
- [Buying models through a marketplace](https://kirto.com/blog/buying-models-through-a-marketplace): A model marketplace sits where the provider sits: it holds the prompt, sets the retention and keeps the record of each call. Its own pages say where prompts go and how long they stay, and the record stays with the marketplace.
- [Calling a detector](https://kirto.com/blog/calling-a-detector): A gateway can call any detector, and what comes back is a verdict about the string it handed over. Presidio, Lakera, Prisma AIRS, Guardrails AI and NeMo are all called this way. Deciding on the verdict is still the job of whatever holds the connection.
- [Comparing the six positions](https://kirto.com/blog/comparing-the-six-positions): Three questions can be asked of any vendor on the AI request path, and each of its six positions answers them differently, Gate included. Ten posts, six positions, one question each, on one figure.
- [Governance platforms](https://kirto.com/blog/governance-platforms): A governance platform cannot produce evidence of a call it did not witness. The runtime that witnessed it has to hand over a record the platform can check without trusting the runtime. Credo AI, Holistic AI, IBM's watsonx.governance and OneTrust own the policy document and the evidence binder.
- [Personal data in a prompt](https://kirto.com/blog/personal-data-in-a-prompt): A code review cannot list the personal data that leaves the company, because a prompt is assembled at runtime. It is built from a conversation, a record lookup and a tool result, so the request itself is where the question has an answer.
- [Policy, enforcement and evidence](https://kirto.com/blog/policy-enforcement-and-evidence): In most AI programmes nothing on the request path enforces the policy while the call is in flight. Policy decides what should be true. Evidence shows afterwards that it was.
- [Proxies and the unified API](https://kirto.com/blog/proxies-and-the-unified-api): One API for every provider is a good trade until somebody asks what the provider actually received. A proxy that parses your request into its own shape and writes it back cannot answer, because what survives is whatever that shape knew about the week it was written.
- [Response caching](https://kirto.com/blog/response-caching): A response cache in front of the model saves the whole call, including the part where something decided about it. Caching belongs where the model's own cache is, and a gateway earns the provider's discount by leaving the bytes alone.
- [The cloud's own AI services](https://kirto.com/blog/the-clouds-own-ai-services): Bedrock Guardrails, Azure's API Management and Google's Model Armor are excellent inside the account that runs them. The record they keep lands in that account too, under its IAM, which decides what a verifier outside the account can establish.
- [Where AI governance came from](https://kirto.com/blog/where-ai-governance-came-from): By 2 August 2026 the EU had deferred every AI Act obligation shaped like model approval, and left standing the one discharged while the system is in use. AI governance was built for the first kind: an inventory, a validation, documentation, a gate before deployment.
- [Who is on the request path](https://kirto.com/blog/who-is-on-the-request-path): Six kinds of product sit on the path between your application and a model. This series takes them one at a time and asks each what it can do while it holds the connection, and whose record it keeps.
- [One discipline, two standards bodies](https://kirto.com/blog/one-discipline-two-standards-bodies): BPMN, CMMN and DMN come from the OMG, and Arazzo comes from the OpenAPI Initiative, a body with no relationship to the OMG. Kirto Flow executes both the same way, because the discipline is executing the real spec instead of inventing one, whichever body wrote it.
- [What the agent control plane is](https://kirto.com/blog/what-is-the-agent-control-plane): The agent control plane observes, governs and proves every AI agent, across every vendor. It watches each agent's calls from outside the agent's loop, runs the processes agents work inside, and leaves records a third party can check.
- [The control plane cannot be built by the platform it governs](https://kirto.com/blog/incumbents-cannot-become-control-plane): A control plane for agents across vendors has to sit outside every vendor's platform, and the companies selling orchestration, durable execution and agent frameworks earn their revenue inside one. Kirto splits the job: Gate holds the request path for any vendor's agents, Flow runs the processes agents work inside, and both write records a third party can check.
- [Orchestration and choreography in one model](https://kirto.com/blog/choreography-vs-orchestration): Orchestration gives one participant the global view, and choreography gives it to nobody. A CMMN case runs choreographed plan items inside one auditable case model, and it can dispatch an orchestrated BPMN process as one of its tasks.
- [Why AI increases fragmentation](https://kirto.com/blog/ai-increases-fragmentation): AI adds execution paths to the enterprise faster than it retires them. Each new model, agent and protocol joins the systems already running, and governance that lives in a design-time model cannot see what an agent does at runtime.