'This action is fine, except after that one'
How Kyvvu is building an operating-system kernel for autonomous AI agents: the anatomy of the "lethal trifecta".
Published on October 21, 2026
Kyvvu, Maurits Kaptein
Bart, co-founder of Media52 and Professor of Journalism oversees IO+, events, and Laio. A journalist at heart, he keeps writing as many stories as possible.
Ahead of the AI Pitch Competition finals on 12 November at the Evoluon in Eindhoven, IO+ continues its deep-dive series profiling the eight finalists and one wildcard. In this third instalment, Maurits Kaptein, co-founder and CTO of Kyvvu, discusses why agent security shouldn't rely on LLMs judging other LLMs, the anatomy of the "lethal trifecta," and why execution paths, not isolated steps, hold the key to keeping autonomous software in check.
As enterprise software shifts from passive chatbots that suggest text to autonomous AI agents granted real digital authority - reading customer databases, wiring transactions, triggering CI/CD pipelines, and executing code - the risk equation changes fundamentally. A wrong conversational response is an inconvenience; a rogue digital action is a corporate incident.
Yet, when autonomous agents cause havoc, it is rarely because a single step was explicitly forbidden. Catastrophe almost always occurs when an agent strings together several entirely permitted actions in a harmful order.
Based at the Jheronimus Academy of Data Science (JADS) in 's-Hertogenbosch and backed by the Brabantse Ontwikkelingsmaatschappij (BOM), startup Kyvvu is tackling this critical architectural blind spot. Below, co-founder and CTO Maurits Kaptein (who also holds a chair at Eindhoven University of Technology) explains why agent governance requires a deterministic reference monitor built directly into the agent's execution process.
The 'Lethal Trifecta' and the flaw of stateless security
Industry data shows that enterprise adoption of autonomous software is outpacing operational control: recent surveys by the Cloud Security Alliance reveal that 82% of enterprises have unknown AI agents running in their environments. Worse, roughly 98% of production agents already exhibit what security researcher Simon Willison termed the lethal trifecta: access to private internal data, exposure to untrusted external content, and the ability to send outbound messages.
"Kyvvu builds an Agent Security Kernel: a small library that runs inside the agent's own process and checks every action the agent is about to take - reading a file, calling a tool, sending a message - against a policy before the action executes," Kaptein explains. Crucially, Kyvvu rejects the popular trend of deploying a secondary language model as an AI supervisor: "The check is deterministic: no LLM in the loop, no model judging another model."
Kyvvu breaks ground by evaluating state and context over time. "What is unusual is that the policy is evaluated against the full path of the task so far, not the isolated step," says Kaptein. "An agent that is allowed to read customer data and allowed to send an email may still be stopped from doing the second right after the first. Most existing controls sit at the network edge (gateways, proxies) or check one step at a time; neither can express 'this action is fine, except after that one.'"
As Kaptein details in a recent white paper on agent security (Building Secure Agents at Scale), conventional security mechanisms, like role-based access control (RBAC), sandboxing, and I/O guardrails, are stateless. They see only one identity, one message, or one API call in isolation. Recent in-the-wild incidents illustrate the vulnerability: in attacks like PipeLeak on Salesforce Agentforce and ShareLeak on Microsoft Copilot Studio, agents were prompted to read sensitive corporate repositories and email the contents out. Every individual call was technically authorised, making the exfiltration invisible to traditional firewalls.
The remedy, Kaptein notes, draws on foundational computer science: "The idea itself is old; it is a reference monitor, a construction from operating-system security, applied to agents."
Securing the harness, not the non-deterministic model
Kyvvu's architecture rests on a strict separation between the foundation model and the harness, the deterministic application code that executes tools, calls APIs, and manages the agent's runtime loop. "Trying to guarantee security by prompting the model to 'behave' is not a control," Kaptein argues. Foundation models are inherently non-deterministic and can be adversarially steered by poisoned web pages, database records, or third-party tool outputs. A true security guarantee must reside in the deterministic code the organisation actually owns: the harness.
Furthermore, Kaptein warns against "sniffing the wire" via external AI gateways or proxies. "An AI gateway inspects what the model proposes to do, authored by the untrusted model itself, but it never sees what the harness actually executes," Kaptein writes. "Tool calls and embedded models slip past it. The moment a gateway reaches into the model call to enforce security, it inserts itself into the critical data path and takes on its own exfiltration and prompt-injection risk. Enforcement belongs where the actual actions are: inside the harness."
Because Kyvvu’s Agent Security Kernel (ASK) runs directly inside the host process as a lightweight library (or sidecar), decisions execute in under a millisecond—logging 296 microseconds at the 99th percentile.
"The engine is a library, so it scales with whatever the agent scales on; there is no central server in the path of the agent's work," Kaptein says. "The hard part is not compute but integration: an agent framework has to expose its actions to the kernel once, and there are many frameworks, changing weekly. We ship integrations for the major ones (LangChain, LangGraph, Claude Code, and others), but the real fix is a shared vocabulary for agent actions that frameworks emit natively. That is why we published the Agent Action Grammar as an open standard. In the end, we want to be in every sensible AI agent ever deployed."
Auditable policies and the limits of scope
Because Kyvvu governs execution steps rather than evaluating human sentiment or screening demographic traits, standard algorithmic bias pitfalls do not apply directly to the kernel itself. "Kyvvu does not make decisions about people, so the usual bias concerns about AI decision-making do not arise in the engine; it decides about actions, using rules the customer wrote," Kaptein emphasises. "Transparency is the design: every policy is a human-readable file kept in the customer's own version control, and every decision leaves a trace stating which rule fired and on which step. An auditor can read both without taking anyone's word for it."
The ethical trade-off rests instead on boundary awareness: "The ethical question we do face is scope: a control that only covers the actions it was wired to see can give a false sense of safety. We state that limit in our documentation as a property of any such system, and we tell customers what the kernel covers and what it does not."
A precondition for enterprise agent adoption
For mission-critical sectors such as banking, tax collection, and clinical healthcare, unconstrained autonomy is a non-starter. "Organisations are giving AI agents real permissions—to read records, move money, change systems—and the accidents so far come from agents doing many individually permitted things in a harmful order," Kaptein observes. "I think the technology that lets a hospital, a tax authority, or a bank run agents within rules they wrote themselves is a precondition for agents doing anything useful in those sectors at all."
Yet Kaptein is quick to warn against the psychological trap of false complacency: "The risk I see is the opposite one: that a runtime control becomes a licence to deploy agents more carelessly, because 'something is checking.' We try to counter that by being explicit about what is checked, and by keeping the policy in the customer's hands rather than selling a default."
Compliance as a natural by-product of runtime enforcement
When it comes to data privacy frameworks and the EU AI Act, Kyvvu rejects the notion that companies need to buy a separate, disconnected "agent governance" dashboard. "Two things follow directly from our architecture," Kaptein explains. "First, data never leaves the customer's environment, because the kernel runs inside the agent's process; that removes most GDPR questions about a vendor processing personal data. And second, every policy decision is recorded, which is the kind of evidence the AI Act asks for from high-risk systems."
As Kaptein articulates, runtime enforcement naturally guarantees observability: "Observability means you can see what the agent did; enforcement means you can stop what the agent is about to do. Observability built on top of enforcement is real and valuable because the record is trustworthy precisely because the same mechanism that wrote it also had the power to stop the action. We consider the trace a by-product, not the product: we build the control that makes an agent do the right thing, and the record that it did so comes with it."
The Brabant bridge and the need for European standards
Kyvvu's development draws directly on the regional academic and business climate. "Kyvvu holds office at JADS, Den Bosch, and I personally hold a chair at TU/e in Eindhoven, so the research and the company sit in the same ecosystem; BOM is among our backers," Kaptein says. "The Netherlands has been a good place to find early customers: public bodies and financial institutions here are willing to pilot new controls and are serious about doing so properly."
However, he sees a strategic gap when looking at European digital governance as a whole: "What is missing is less local than European—there is no European home yet for open standards in agent security. The relevant working groups are American or run under US-based foundations. We participate in them; I would rather also have a European one."
The AI Pitch Competition
Read all the articles from the AI Pitch Competition here (also last year's)
Taming the disruptive power of agency
When asked about the existential polarization framing artificial intelligence, Kaptein brings the conversation back to engineering fundamentals.
"I find the 'AI for Good vs. AI for Disaster' framing not necessarily wrong - it depends on definitions - but not immediately useful," he notes. "The disruptive part of the current wave is not that models are clever; it is that they are being given the ability to act, at scale, with real permissions. Both the benefit and the harm come from that, and both are decided by mundane engineering: what an agent may do, in what order, with what checks."
"The incidents we have seen so far were not model failures. They were sequences of permitted actions nobody had thought to constrain. That is a solvable class of problem, and solving it is what makes the 'good' side available at all. We are building that solution."
Substantiated rigour over shiny interfaces
Looking toward the pitch showdown at the Evoluon on 12 November, Kaptein remains grounded about the contest. "In ten years I expect action-level runtime policy to be a totally unremarkable, but omnipresent, layer of the agent stack, the way access control is for operating systems today," Kaptein envisions. "Whether the company that does this is called Kyvvu in 2036 matters less to us than whether the layer exists and is open."
As for why Kyvvu should take home the trophy: "I don't know that we will; we are not deciding," Kaptein concludes. "What I can say is that we are one of the few teams that have written down very clearly what the problem is, an agent's actions as a path, and a policy over that path, before even building the product, and that the problem statement is public and open on arXiv for others to adopt. Sure, we have demos, but we hope the jury will weigh a genuine attempt to solve a pressing problem in agent security at a global scale over flashy interfaces."
Erasmus Enterprise, BOM, and IO+ organise the AI Pitch Competition, supported by the Province of North Brabant. The finals take place during AI Summit Brainport on 12 November at the Evoluon in Eindhoven.