KAS, the agent-action gate

The product page is /kas. The drafts below are not in force. Certification is in progress. Qypu holds no certificate yet.

Governance drafts

• KAS customer communication · 1.1.1, 1.1.2, 1.1.3

  How Qypu tells people what KAS does, when an agent is acting, and that the gate has no chat screen to label.

• KAS incident notification · 1.5.1, 9.5.4

  How Qypu would tell end users about a KAS incident, and the draft process for a decision that should not have stood.

• Report a KAS concern · 1.6.1

  A public email channel for an adverse impact of KAS, and a draft promise not to punish a good-faith report.

• KAS security and disclosure · 5.8.1, 5.13.1

  How to report a KAS vulnerability to security@qypu.ai. Draft: 2 working days to acknowledge, and 7 days to triage.

• KAS acceptable use · 9.1.1

  What you can use KAS for, what you must not do with the gate, and who answers for a model's words.

• KAS third-party rights · 8.5.1

  Where the KAS code licence lives, how third-party material is treated, and how to send a rights claim.

• KAS impact statement · 11.1.1, 11.2.1, 9.11.1

  Who KAS is meant to help, the environmental load we have not measured, and a check against a non-AI alternative.

Pages that already exist

• Privacy policy, with a KAS section, and the Personal Data Protection Act 2012.
• Trust centre privacy notice, including the Singapore annex.
• AI transparency and the trust centre AI disclosure, for products that draft content. KAS has no chat.
• Incident and breach notification for the Qypu product. Those deadlines are not confirmed for KAS.
• Vulnerability disclosure for qypu.ai. KAS uses the same draft times: 2 working days to acknowledge, and 7 days to triage.
• Acceptable use for the social product.
• security.txt.

The short version

This short version helps you understand the full text. Read the full text for the complete terms.

• KAS stops an agent from taking an action you have not allowed. (Full text, What KAS does)
• Qypu stands behind that guarantee. (What this is meant to stop)
• You can see what your agents have done. Each decision is a signed receipt. (The tape and witnesses)
• KAS is in build. (Status)
• Certification is in progress. Qypu holds no certificate yet. (Status)
• The gate does not train a model, and it has no chat. (What KAS does not do)

Full text

What KAS does

KAS is Agentic Shorthand. It is a language and a gate for agent actions. Qypu builds KAS. Byron Fuller wrote the code.

An agent's card declares the effects it can take. A person signs a mandate that caps those effects. The gate then allows, refuses, or holds each action. In enforce mode, the effect runs only after an allow.

The README describes two ways to authorise an action, and four rungs of use. Those names stay in the README. This page does not rename them.

You can run the gate in observe mode, and then in enforce mode. Enforce mode fails closed. A switch back to observe can require the owner, plus a wait.

Commit signatures default to ML-DSA-65 together with Ed25519. The README states that default.

What this is meant to stop

In enforce mode, the gate stops an effect the card does not declare. It also stops an effect the mandate does not allow. A wildcard that would permit any effect is rejected. A refusal is stored, not dropped.

KAS guarantees that an agent does not do a job you have not allowed. Qypu stands behind that guarantee.

What KAS does not do

KAS does not train a model, and it does not ship one. It does not write chat, text, or images. It does not store prompts, because it does not call a model.

A receipt records the call, the effect, the rule, and hashes. It does not store the other arguments, such as a memo.

The safety notes list residual risks. One group is within-bounds lies, covert channels, and a stolen issuer key. Another is a wrong checker, a wrong pack, and a person who approves a bad artifact.

A public sentence can still carry a secret in the wording. The project does not claim to block that channel.

Certification

Certification is in progress. Qypu holds no certificate yet.

SOC 2 Type II: independent audit in progress. Cyber Essentials (UK): certification in progress. Cyber Essentials (Singapore): certification in progress. CyberSecure Canada: certification in progress. Essential Eight (Australia): alignment in progress.

The EU AI Act readiness review is in progress. For the IMDA agentic AI framework, KAS is built to follow it, and the review is in progress.

Privacy reviews are in progress for the Singapore PDPA, Canada PIPEDA, Quebec Law 25, the Australia Privacy Act, and the NZ Privacy Act.

The tape and witnesses

Every decision gets a signed receipt. An allow, a refusal, and a hold each get one. Receipts are appended to a tape. Old receipts are not edited. A reader can check a proof that a receipt sits in the tape. The tape note is docs/TAPE_v0.md.

A witness is a separate party. It checks the tape and adds its own signature. It does not allow or refuse the agent's actions.

You can see what your agents have done. The tape is that record.

How to run a witness

Follow witness-kit/README.md in the repository. This page does not copy the commands. The kit is the procedure, and the procedure can change with the code.

Run the witness on a machine you control. Run it as someone other than the person who operates the gate. That split is what makes the signature independent.

If a link on this page does not open, the path is still the name of the document.

Papers and the source

The source is the GitHub repository. These files are the ones this page relies on.

• README.md, the purpose, the two regimes, and the four rungs.
• docs/EXPLAINER.md, a shorter account of the language.
• CHEATSHEET.md, the short form.
• docs/TAPE_v0.md, the tape.
• whitepaper_v0.1.md, the argument for a check before effects.
• SPEC_v0.1.md, including MCP and A2A in section 9.
• SAFETY_OBSERVABILITY.md, limits and residual risk.
• SECURITY.md, the draft disclosure note.
• GOVERNANCE.md, a plan, not a record of work done.
• packages/kas-gate/README.md, the packaged gate.
• CHANGELOG.md, the packaged gate's change log.

Status

KAS is in build. The examples on the product page are not a live record.

A pilot protocol for 5 to 8 people is in the repository. The protocol says the pilot has not been run.

The same author wrote the Go gate. GOVERNANCE.md says the handover test for an independent team is still open.

Governance on this website

The product page is KAS. The drafts on this page cover communication, incidents, concerns, security, use, licensing, and impact. Personal data is covered in the privacy policy and the trust centre privacy notice. AI labels for drafted posts are on the AI transparency page. KAS itself has no chat to label.

Change log

• 2026-10-25 · 0.1.2 · This overview moved to /kas/trust. Certification is in progress. No certificate is held yet.
• 2026-10-23 · 0.1.1 · Status stopped pinning a version number.
• 2026-10-23 · 0.1.0 · First public draft. Not in force.

Contact

Qypu, Inc., a Delaware C corporation. Contact address: 51A Marang Road, Singapore 099281. Privacy mail privacy@qypu.ai and security mail security@qypu.ai route to Byron Fuller.

KAS · KAS governance · Trust centre · Privacy · Privacy notice