DarlaStack Kernel sits at the tool-dispatch boundary. Every proposed action is checked against a versioned contract before it runs — allowed, blocked, escalated for approval, or degraded — and written to a tamper-evident audit trail that can be replayed against any rule version. Deterministic execution governance for agentic systems.
Modern AI agents call tools across multiple steps. State persists between steps. A read in step one looks innocent. An egress in step two looks routine. The combination is exfiltration. Most policy checks evaluate calls in isolation — the cross-step pattern slips through. The risk lives in the sequence, not the individual call.
A two-step read-then-egress where each call is acceptable in isolation. The agent reads a config file containing an API key. Then it sends "telemetry" to an external webhook. Reviewed independently, both pass. Reviewed as a sequence, the second action is an exfiltration path if the runtime carries the read result into the egress payload.
DarlaStack Kernel preserves session context. When step two arrives, the kernel sees that step one read a configuration file in this session and that the proposed egress payload is large enough to plausibly carry that content. A declared cross-step invariant fires. The action is blocked through a critical invariant, regardless of authority tier. The current contract blocks this regardless of how authoritative the caller claims to be.
Each decision is bound to canonical input values, not just operation names. Different inputs produce different audit digests. The chain is tamper-evident — any retroactive edit breaks the linkage and is visibly detectable. Inputs are preserved for replay, so a decision made today can be reconstructed exactly tomorrow.
Rules drift. Policies tighten. The Time Machine takes a historical audit log and re-evaluates every decision against a newer contract. Which past actions would be decided differently under the policy we have now? It surfaces drift, supports retrospective review, and gives compliance functions a structured way to ask the question that auditors actually ask.
DarlaStack Kernel is designed to sit at the mandatory tool-dispatch boundary. A production integration must ensure that all tool calls pass through DarlaStack Kernel — the kernel only protects what is routed through it. Three deployment shapes are supported, each with different security properties; choose based on existing agent architecture.
# Embedded library — minimal latency, requires trusted in-process call site from darlastack import Kernel kernel = Kernel.load_contract("contracts/devops_v1.2.2.json") decision = kernel.evaluate(operation="read_config_file", inputs={...}) if decision.allowed: run_tool(...)
Library import inside the agent process. Lowest latency. Requires the integrator to ensure all tool calls actually go through the kernel — bypass risk lives at the call site.
DarlaStack Kernel runs as a co-located process. Agent calls a local socket before tool execution. Stronger boundary than embedded; assumes the agent cannot launch tools out-of-band.
DarlaStack Kernel fronts the tool API surface. Agent has no direct path to tools — every call routes through the gateway. Strongest mandatory boundary, highest latency, requires network plumbing.
DarlaStack Kernel enforces declared rules over declared actions. It does not infer hidden intent, prove universal AI safety, or provide automatic legal compliance. It is not a malware sandbox, an IAM replacement, a SIEM, a DLP product, or a complete compliance platform.
A production deployment must ensure all tool calls pass through DarlaStack Kernel, that audit evidence is stored in durable encrypted storage with access control, and that surrounding systems still handle identity, runtime security, and human process. DarlaStack Kernel is the deterministic reference monitor — not the entire security architecture.
A bounded paid engagement to prove DarlaStack Kernel against your real agent-tool boundary. We map the workflow, write the first contract, run baseline attack chains, and produce a replayable audit log plus a written go/no-go report on production integration.