KYE™ Delegated Auditability™

Runtime accountability for AI agents — without replacing IAM.

KYE™ adds a delegated-authority and evidence layer on top of your existing IAM, OAuth, API gateway, workflow, SIEM, GRC and AI-agent stack. Start in shadow mode: observe AI-agent actions, capture who or what acted, on whose behalf, under what authority, inside what scope, and generate Evidence Packs™ before enforcing runtime controls.

Apply for pilotView Evidence Pack™See financial-services workflow

KYE™ Delegated Auditability™ (Evidence and reports), stage by stage

Demo data

You learn: How it works, one stage at a time. You can: Run it end to end.

  1. Bind

    KYE Protocol™

    A KYE™ operator helps you install one or more read-only Stack Bindings. Default mode is read_only . No production change.

  2. Observe

    KYE Protocol™

    Each bound stack streams Observed Actions to the KYE™ Evidence Gateway™. A Shadow Evaluation fires for each one.

  3. Review

    KYE Protocol™

    KYE™ returns Authority Gaps and Guard Recommendations. Your CISO and AI risk officers triage them in KYE™ Cloud™.

How this widget is built
Demonstrates
KYE™ runtime
Components
  • The stages this page describes
Flow
Each stage in order, as the page sets it out. Architecture diagram
Used on

The problem

Why IAM is not enough.

An OAuth token says this caller is identified and authorised to call this API. It does not say:

  • On whose behalf the agent claims to be acting — principal, delegation chain, time window.
  • For what purpose the call is admissible — data classes, jurisdiction, restrictions.
  • Under what scope the action is bounded — resource, amount, blast radius.
  • Whether a regulator can replay the decision offline.

Delegated Auditability™ is the smallest possible KYE™ adoption that closes those four blind spots — without altering one line of your production code path.

Adopt KYE™ incrementally

Adoption is staged — you pick how far you go.

Customers begin in observe-only mode (read-only stack binding, signed Observed Actions, production unchanged) and graduate through evidence, alert, guard, enforce and expand stages on their own schedule. The specific stage enumeration, the per-stage promotion criteria, and the rollback contract are proprietary and are not disclosed in this repository — they live in the private Adoption Stage State Machine and are governed per-customer by signed transitions.

Observe

Read-only stack binding. Production unchanged.

Guard

Smallest possible Authority Gate or Purpose Permission installed — in shadow first.

Enforce

Promoted Guards block on production. Each promotion is a signed adoption-stage transition.

Shadow mode

Shadow mode is a flag, not new code.

Every KYE™ Engine — Authority, Purpose, Decision — supports a mode parameter. Under mode: shadow, every check still runs, every Decision Map™ is still sealed, every Evidence Pack™ is still signed — but the Commit Boundary™ suppresses every side effect. production_action_blocked is invariantly false.

Full shadow-mode contract

Evidence Pack™ example

A real bundle from a supplier-payment pilot.

One observed action — supplier_payment_agent prepares £950 payment for invoice inv_123. The KYE™ Shadow Evaluation runs all six engines and returns simulated_requires_approval. The Authority Gap classifier opens a missing_authority_grant gap. The Guard Recommendation proposes an Authority Gate. The Evidence Pack™ bundles every artefact for offline replay.

Open the Evidence Pack™ viewer

Built above your existing stack

Eleven read-only Stack Bindings — no migration required.

IAM / SSO

Okta, Entra ID, PingFederate, Auth0, Keycloak. Roles, groups, sessions.

OAuth / OIDC

Scopes, tokens, claims, refresh chains.

API gateway

Kong, Apigee, AWS API GW, Cloudflare. Per-call observation.

MCP servers

Any MCP-conformant server — tool calls captured as Observed Actions.

AI-agent frameworks

LangChain, LlamaIndex, AutoGen, OpenAI Agents SDK.

Workflow engines

Temporal, Camunda, AWS Step Functions, n8n.

SIEM

Splunk, Sentinel, Elastic, Chronicle — alert fan-out.

GRC

OneTrust, Drata, Vanta, ServiceNow IRM.

Policy engines

OPA, Cedar, Styra DAS.

Audit logs

Read-only ingest from any append-only log.

Data stores

Snowflake, BigQuery, Postgres, S3 — for data-class tags only.

Integration path

From day 1 to first Evidence Pack™ — in three steps.

  1. Bind. A KYE™ operator helps you install one or more read-only Stack Bindings. Default mode is read_only. No production change.
  2. Observe. Each bound stack streams Observed Actions to the KYE™ Evidence Gateway™. A Shadow Evaluation fires for each one.
  3. Review. KYE™ returns Authority Gaps and Guard Recommendations. Your CISO and AI risk officers triage them in KYE™ Cloud™.

Pilot CTA

Apply for a pilot.

Pilots run 30–90 days, end with a signed Audit Pilot Report and a prioritised list of Guard Recommendations. Applications are manually qualified within 2 business days.

Apply for pilotTalk to the team

Canonical KYE™ surfaces referenced on this page: Audit Pilot · Delegated Auditability · Evidence Pack™ · KYE™ Cloud™ · KYE™ MCP Server · KYE Protocol™ · Purpose Permission.