# KIFF

> KIFF gives each AI agent a Card: which actions it may take, how much per action and in total over a window, and what happens to a call outside those limits. KIFF decides every proposed consequential action before it runs, against the business's own state and the agent's Card. A call outside the Card waits for the owner or is refused. The owner changes or revokes the Card without changing the agent, and every decision has a signed, tamper-evident receipt.

Agents now refund, credit, book, cancel and change accounts on their own. Each action costs almost nothing, so teams ask for many more of them, and a person approving each one becomes the whole cost. Payment networks now give agents credentials capped per payment. A payment cap knows one payment. KIFF covers what it cannot see: actions that are not payments, totals over time across agents, the state of the order or account, who answers when the agent goes over, and a record the agent's vendor did not write. In one line: payment networks cap a payment; KIFF caps the agent.

## Key facts

- What a Card says: which actions the agent may take (refund an order, not cancel a subscription); the most per action; totals per window, counted as a number of actions or a sum of one parameter (for example €500 and 10 refunds a day); what happens outside it (hold for the owner, or refuse); an optional expiry. One agent holds a Card by default; a Card can also be shared by up to 20 agents drawing on one balance, and each decision still names the agent that asked. An agent holding several Cards is bound by the tightest.
- How a call is checked, three ways: (1) the MCP gateway at `mcp.kiff.dev`, the agent's key asks KIFF before forwarding; default `sealed` connections give KIFF the downstream credential, while configured `verify` and `relay` connections require an execution permit at the tool or customer-run relay; (2) kiff-guard, one hook in the agent's tool loop in your own code (Python and TypeScript, eleven verified framework adapters); (3) one call to the decision API, `POST /v1/proposals/decide`, from any code. Outcomes: `allowed`, `approval_required`, `blocked`, `invalid`.
- What "allowed" means: KIFF authorized the call. Through the gateway KIFF then forwards it to the tool; elsewhere the company's own system runs it. KIFF never moves money itself.
- Outside the Card, the owner answers: a held call reaches the owner on Needs you, by email, and as a link in the agent's chat (Claude Code). The owner approves it once, revises the Card, or rejects it. Approve once lifts only the per-action limit: the call still counts toward every Card total, and if no room is left it waits as `approved_no_room` until there is room: the window resets or earlier usage ages out, or an admin revises the Card or adds room (this window only by default). The approval and the Card must still be valid when the call is retried; someone can also reject it. A person answers from a signed-in session; an admin can also grant a separate approver service bounded authority to answer an Ask Card's holds, without adding budget or changing the Card. A hold nobody answers is refused when it expires (10 minutes by default). An agent key can never answer an approval it asked for.
- The owner changes the Card, not the agent: raise it for a busy week, narrow it, move it to another agent or revoke it, and new authorization uses the new terms. Revoking one Card withdraws only what that Card granted; already issued execution permits can remain usable until expiry.
- Correct under load: concurrent calls, retries and several workers draw on one balance held centrally. A retry counts once. Two runs cannot both spend the last of a balance. If the balance cannot be read, KIFF refuses; unknown is never read as zero.
- The record: every change to a Card is attributed, every draw is on the Card's statement, and every decision has a signed, tamper-evident receipt the agent cannot write. The draw is recorded when the action is authorized, not when the caller executes it.
- Under the Card is the operational domain (a versioned `kiff.yaml`: entities, states, actions, permissions, approvals). KIFF decides every proposed consequential action against it, from the real state rather than what the caller claims, and a caller cannot approve its own request. Where an action declares `requires_authority`, that decision also draws on a card the organization issued to the acting agent. A card narrows what the domain allows; it cannot make a forbidden action legal.
- Where the Card is the final authority: wherever KIFF is on the only path to the capability, as through the gateway. An agent that can still act through a browser or a direct credential is outside it; close that path, or KIFF does not govern it.
- Shipped today: Cards with per-window limits, shared Cards and statements; the MCP gateway (remote MCP); held calls with owner approvals and expiry; eleven kiff-guard adapters; Claude Code and Codex through the gateway; signed receipts; the MIT framework. Newly implemented: execution permits and `verify`/`relay` custody modes, requiring a deployment with permit signing enabled and a configured verifier. Existing sealed connections do not migrate automatically. Direction, not product: company identity integration, narrower delegated Cards, controls across many agents at once, a view for builders running several clients, and payment credentials created only after an `allowed` decision.
- Who it is for: businesses whose agents take consequential actions on their own money or operations (refunds, credits, payouts, plan and access changes), and the builders who deliver those agents to clients. Not sold to consumers using a personal agent; their protection belongs to the payment layer and the agent's own confirmations.
- Open source and price: one KIFF account has one plan, covering the tafs app and KIFF Cloud for the account's own agents, after a 7-day trial (25 tafs tasks, 500 KIFF actions). Solo: €8.99 a month for one person, with 20 tafs tasks and 500 KIFF actions a month. Team: €8.99 a person a month, from 2 people, with 20 tasks and 500 actions a person, pooled. Company: committed volume, on an order form. Past the included ones, a KIFF action costs €0.02, and tafs tasks come from task packs, bought once and valid for 12 months: Pico (12 tasks) €4.99, Vonk (30) €9.99, Rayo (70) €19.99, Forte (200) €49.99, Maxi (450) €99.99. Only calls that KIFF allowed, that were sent, change something and worked are counted; refusals, halts, failures and reads are free. Plan prices exclude VAT; pack prices include it. The KIFF Framework (Go) and the kiff-guard SDKs are MIT and need no account.
- For coding agents (Claude Code, Codex and similar): install the KIFF skill from `https://kiff.dev/skills/kiff.md`. It connects a tool through the gateway, drafts a Card for the owner to issue, and handles a held call: retry the identical call with the same `kiff_operation_id`, and never make the same change another way.
- What it is not: not an agent platform, a workflow engine, a model gateway or an app builder. It works alongside them.

## Core

- [KIFF](https://kiff.dev/): Give the agent a Card. A KIFF Card holds a set amount of authority that the agent uses up as it acts; the business gives it more or takes it back without a release or a change to the agent. The Card lives with the business (which actions, in which states, how much, until when), not in the agent’s code. The owner raises, lowers or revokes a card and the next request uses the new terms; each agent holds its own cards, so revoking a card withdraws only the authority that card granted and leaves other agents untouched; every change and decision stays on record. KIFF answers each proposed action before your system runs it. KIFF Cloud comes with every KIFF plan, from €8.99 a month after a 7-day trial.
- [KIFF for agents](https://kiff.dev/agent): The canonical machine-entry page, what KIFF does, when an agent should (and shouldn't) use it, the real decision API (POST /v1/proposals/decide; outcomes allowed/approval_required/blocked/invalid), minimal integration, current status, and links to every machine surface.
- [Why KIFF](https://kiff.dev/why): The founder's account: a Card for every AI agent, as familiar as a corporate card; why authority and credentials belong outside the agent; why agents acting on money and accounts is about to be normal; built for companies, with individuals named only as a hypothesis for later; the direction of one Card that travels across every assistant (ChatGPT, Claude, Grok and others), marked as not built yet; and why it has to be open source.
- [KIFF Cards whitepaper](https://kiff.dev/whitepaper): Delegated work, business tasks and MCP tasks, Card authority, limits, owner approvals, enforcement, execution permits and the distinction between authorization and execution evidence. Separates implemented behavior, deployment requirements and identity/delegation design work.
- [MCP walkthrough, English](https://kiff.dev/proof/videos/mcp-from-zero-en): Watch the end-to-end MCP setup, current Card limits, owner approval and a real tool call. KIFF production gateway, Stripe test mode.
- [MCP walkthrough, Français](https://kiff.dev/proof/videos/mcp-from-zero-fr): The French narrated MCP walkthrough, with current Card limits and owner approval. KIFF production gateway, Stripe test mode.
- [Customer operations, portrait](https://kiff.dev/proof/videos/customer-ops-portrait-en): A 58-second illustrated scenario for phones: connect tools, issue a Card, allow a €180 credit, hold €1,400, refuse a payment-terms change, and approve once. English narration; downloadable MP4. Fictional example, no live calls.
- [Customer operations, landscape](https://kiff.dev/proof/videos/customer-ops-landscape-en): The same 58-second illustrated scenario for presentations, led by the isometric map. An interactive version is available on /integrate.
- [Proof](https://kiff.dev/proof): A synthetic KIFF Card test run on KIFF’s production services (app.kiff.dev / api.kiff.dev) on 22 Sep 2026, with no customer data, recorded in the product: seven decisions (three allowed, four refused) with seven signed receipts, the owner raising the limit from €5,000 to €8,000 and then revoking the card. KIFF verified the decisions and what they drew from the card; "allowed" does not mean the refund executed, the company’s own system runs it. Also the agent and product demo videos (formerly /videos, which redirects here), and the runnable domain proofs, which show the state machine under a card and are not card evidence.
- [Invariants](https://kiff.dev/invariants): The behavioural guarantees the cloud runtime makes, each anchored to the test that proves it with a file and line. Generated from the test suite by a generator whose own test fails the build when the page stops matching what passes, so it cannot describe a guarantee the code stopped making. Covers the decision API (apps/api) and the MCP gateway (apps/gateway); the page states plainly that a passing test proves the property it tests and nothing else.
- [Production Launch](https://kiff.dev/on-rails): Optional: KIFF gets a company’s first agent action live with them. Count the drafts a person executes unchanged, observe the action on real traffic without refusing anything, issue the agent a card so the clear cases run and a person sees only the exceptions, control-test that path, then hand it over to the operations owner. Observing is agreed first, from the action alone; the rest is scoped from what observing shows. If almost everything needs a human, KIFF says so and the launch stops.
- [Integrate](https://kiff.dev/integrate): The developer journey, the operational domain a card narrows against, Guard's adapters for each agent framework, the coding-agent domain skill that authors a kiff.yaml, and the three-line integration.
- [Delegate](https://kiff.dev/delegate): Interactive walkthrough of a Card, run live on the page with sample agents and sample data. A delegation sentence is broken into its five parts (action, what it applies to, per-action limit, total limit, what happens otherwise), each becoming a line on the Card; the Card is given to a suggested agent, the agent draws it down, a request above a limit is refused, and the Card can be moved to another agent (keeping its balance and statement) or revoked. Ends with a gallery of example Cards for business and personal use, each with why its limits are set and where it is useful.
- [Pricing](https://kiff.dev/pricing): One KIFF account, one plan, for the tafs app and KIFF Cloud for your own agents, after a 7-day trial. Solo €8.99 a month plus VAT (one person; 20 tafs tasks and 500 KIFF actions a month; in the tafs app on the EU App Store, €10.99 a month, VAT included); Team €8.99 a person a month, from 2 people (20 tasks and 500 actions a person, pooled; priority support); Company on committed volume. You pay when something gets done: refusals, held calls you refuse, halts, failures and reads are free. Past the included ones, a KIFF action costs €0.02; tafs tasks come from task packs, bought once for 12 months, oldest first: Pico 12 tasks €4.99, Vonk 30 €9.99, Rayo 70 €19.99, Forte 200 €49.99, Maxi 450 €99.99. When a plan's tasks and packs are used, tafs pause and ask; nothing more is charged until someone adds a pack. Solo and packs can also be bought in the tafs app through the App Store. Plan prices exclude VAT; pack prices include it. The framework and kiff-guard are MIT and need no account.

- [For builders](https://kiff.dev/builders): For anyone building agents on KIFF, for clients or for their own business. Leads with a six-step quick start on test data: connect one remote MCP tool, give an agent a Card, run a call inside it, approve one outside it (it still counts toward the Card's totals), and check what the tool actually did; each step separates what the KIFF skill assists with from what KIFF enforces, and it ends with an invitation to talk to us about a real action. Then: build the agent once and let the owner change its authority: KIFF is the reusable authority layer (limits, ownership, balance, revocation, evidence) that would otherwise be rebuilt for every deployment. Why supervision, not the work, limits autonomous agents; what a card is (a delegation closer to a licence than a payment card); why a hand-written limit fails under concurrency, retries, restarts and outages; and the phases of building with KIFF (integration and control testing, owner handover, then operations views once live). A clearly labelled section covers directions not built today. The walkthroughs are illustrative. Implementation scope, price and duration are agreed before work begins.

## Tutorials

- [From a refund tool to an agent with a €50 Card](https://kiff.dev/blog/from-a-refund-tool-to-a-governed-mcp-agent): An end-to-end tutorial with the external Stripe test-mode MCP adapter, Lambda hosting, paid test order, KIFF connection and Card forms, Codex configuration, downloadable Python examples, and prompts for an allowed refund, owner approval, and changed limit. Real screenshots and recorded results; explains the generated gateway domain and the limits of this integration.
- [tafs: AI teammates that work inside the limits you set](https://kiff.dev/blog/tafs-ai-teammates-inside-limits-you-set): What tafs is (an iPhone and iPad app for AI teammates under KIFF Cards), how a job becomes a taf with its own connection and limits, what is held or refused, the signed receipt checked on the device, what is live today, and the source-available repositories.
- [tafs: from one sentence to a refund, inside a Card](https://kiff.dev/blog/tafs-from-one-sentence-to-a-refund): A recorded run in Stripe test mode on an iPad: a taf set up from one sentence with 50 € per refund and 100 € a day, a €0.50 refund sent, a $300 refund refused for its currency, and what broke on the way.
- [A refund desk for Shopify shops, part 2: it ran](https://kiff.dev/blog/a-refund-desk-for-shopify-shops-part-2): A recorded run on a Shopify development store (test orders and payments): an agent works through six refund emails under four KIFF Cards (refunds, store credit, cancellations, order lookups), refunds two small cases, holds a €240 refund for the owner, who answers Return first, and the next run sends the return instructions. Includes what failed on the way and what is not built yet.

## Product notes

- [An approved refund can still fail](https://kiff.dev/blog/an-approved-refund-can-still-fail): Why authorization and the tool's reported outcome are separate facts, how pending MCP calls are recovered, and how the optional Claude Code plugin brings back the owner's answer. The refund example is illustrative; accounting implementation remains separate.

## The framework (open source, MIT, Go)

- [KIFF Framework on GitHub](https://github.com/kiff/kiff): The protocol kernel, events, state, decisions, actions, approvals, audit. Embed it in your backend; useful with zero cloud. Ships a CLI to scaffold and verify domains.
- [Framework technical paper](https://github.com/kiff/kiff/blob/main/docs/whitepaper.md): The framework's domain model, validation, approvals, state and implementation limits. A separate engineering reference from the Cards product paper.
- [Build a domain with the framework](https://kiff.dev/docs/framework-quickstart): Scaffold a runnable refund domain with `kiff new -scenario refund`, run it, and watch KIFF allow the good refund, hold the risky one for a human, and refuse the duplicate. Local, MIT, no account.
- [What KIFF is](https://kiff.dev/docs/what-kiff-is): Scope, non-goals and the limits to know before building on it.
- [How kiff-guard works](https://kiff.dev/docs/concepts): Observe vs enforce, the one-receipt rule, and the two adapter shapes.
- [Domains](https://kiff.dev/docs/domains): The reusable operational contract.
- [Decisions](https://kiff.dev/docs/decisions): The proposal-to-decision model.
- [Receipts and proof](https://kiff.dev/docs/receipts-and-proof): Tamper-evident evidence that the decision ran before the action.

## kiff-guard (the on-ramp for existing agents)

- [kiff-guard on GitHub](https://github.com/kiff/kiff-guard): Attach to your agent's tool calls, observe what it does, then migrate the risky actions onto the framework. Python and TypeScript, MIT, with adapters for common agent frameworks.
- [Connect an agent](https://kiff.dev/docs/connect-an-agent): Three ways in: the MCP gateway for agents that call MCP tools, kiff-guard for agents in your own code (observe, then enforce against the agent's Card), or one call to the decision API from any code.
- [KIFF Plugins](https://github.com/kiff/kiff-plugins) (beta): `kiff-cards` connects Claude Code to the gateway and installs both skills below; the optional `kiff` plugin adds Card status, held-call notices, owner-answer recovery through read-only `kiff_pending`, and `/kiff`. `/plugin marketplace add kiff/kiff-plugins`, then `/plugin install kiff-cards@kiff` and optionally `/plugin install kiff@kiff`. Claude Code asks for the agent's gateway key and stores it securely. [Installation, permissions and recovery](https://kiff.dev/docs/agent-skill). MIT.
- [KIFF skill for coding agents](https://kiff.dev/skills/kiff.md) (beta): A portable SKILL.md for Claude Code, Codex and similar agents: connect an agent or remote MCP tool through KIFF, propose a Card for the owner to issue, handle held, refused and unknown results, and find the right repository or doc. The skill is guidance; the KIFF MCP gateway enforces the Card. Install guide: [kiff.dev/docs/agent-skill](https://kiff.dev/docs/agent-skill).
- [Domain skill for coding agents](https://kiff.dev/skills/kiff-domains.md): A portable SKILL.md a coding assistant (Cursor, Kiro, Codex, Claude Code, and more) installs so it authors and extends your kiff.yaml domains against the real grammar, states, actions, approvals, permissions, executors. Fetch with one curl.
- Adapter guides: [Agno](https://kiff.dev/docs/agno), [LangGraph](https://kiff.dev/docs/langgraph), [Hermes](https://kiff.dev/docs/hermes), [OpenAI Agents](https://kiff.dev/docs/openai-agents), [Google ADK](https://kiff.dev/docs/google-adk), [Pydantic AI](https://kiff.dev/docs/pydantic-ai), [Strands](https://kiff.dev/docs/strands), [Haystack](https://kiff.dev/docs/haystack), [Microsoft Agent Framework](https://kiff.dev/docs/microsoft-agent-framework), [LlamaIndex](https://kiff.dev/docs/llamaindex), [OpenClaw](https://kiff.dev/docs/openclaw).

## KIFF Cloud (hosted runtime) and Studio (the domain's rendered view)

- [KIFF Cloud](https://app.kiff.dev): The KIFF runtime, hosted, agents and services call it over HTTP to propose an action and get a decision before execution, with approvals, signed receipts, and a governance evidence view.
- [KIFF API](https://api.kiff.dev): The headless runtime contract, POST a proposal, get a decision before execution.
- [Quickstart: give an agent a Card](https://kiff.dev/docs/quickstart): Connect a remote MCP tool and an agent in KIFF Cloud, issue the agent a Card, and answer its first held call. No code.
- [Held calls and approvals](https://kiff.dev/docs/approvals): Owner answers in KIFF Cloud; the agent collects the same call. Read-only pending recovery and the optional Claude Code plugin bring back answers given in time, even when read late. Approval and the tool's reported outcome are separate facts; errors, unknown outcomes and older unrecorded outcomes do not establish success. An unanswered hold is refused after its expiry (10 minutes by default).
- [MCP gateway](https://kiff.dev/docs/mcp-gateway): Connect an agent supporting remote MCP over HTTP to `mcp.kiff.dev`, connect remote MCP tools to KIFF, and check each call against the agent's Card before forwarding. Production smoke-tested with Claude Code and Codex using a temporary test tool. Set up in KIFF Cloud (Connected tools, then the agent's Tools tab) or with the gateway API. The agent connects with a gateway key or by signing in through a connect link (in Claude Code, `claude mcp add` then `claude mcp login`; clients that implement the OAuth device flow can use a code instead). Remote MCP tools only, with a bearer credential or a KIFF permit; KIFF does not sign in to tools with OAuth or connect arbitrary HTTP APIs.
- [Tools that check KIFF](https://kiff.dev/docs/tool-permits): Choose who holds a connected tool's key: `sealed` (KIFF, encrypted), `verify` (the tool checks a short-lived Ed25519 execution permit KIFF signs for each allowed call, with the open-source verifier in `kiff-guard[verifier]`) or `relay` (a relay you run holds the key). The verifier runs each operation at most once and never resends a call whose answer was lost.
- [Govern](https://kiff.dev/docs/govern): Decisions, receipts, approvals, and verifiability.
- [KIFF Cards](https://kiff.dev/docs/kiff-cards): The instrument an organization issues to one named agent: the actions it may take, the entity states it may take them in, a ceiling counted as `count` or `sum(<parameter>)` over a window, and an optional expiry. Required only for actions the domain declares `requires_authority`, where absence is refused with `no_mandate_issued` and any proposal that would draw on a card needs an API key issued for its holder (`key_not_bound_to_agent`, `actor_not_key_holder`). Draws are recorded at authorization, not execution; issuing and revoking are management actions a runtime key cannot perform.
- [Cards in practice](https://kiff.dev/docs/cards-in-practice): Six worked examples: a refund agent with a daily budget and a held call approved once, store credit only on eligible cases, plan changes refused past a daily count, a new agent started on a small Card, two agents sharing one budget, and stopping one agent.
- [Limits, warnings and extra room](https://kiff.dev/docs/card-limits): When a Card's day starts (the account time zone), changing a limit, temporary extra room (this window only by default), and budget warnings by email, webhook and `kiff_card` forecasts. Warnings never block, approve or add room.
- [tafs: how it works](https://kiff.dev/docs/tafs): What a taf is and how the iPhone and iPad app works: a taf's Card, Needs you (approve once with Face ID, another option, or refuse; no answer means refused), Coach mode, chat, the notes a taf keeps and can be told to forget, and the Record.
- [Try a version beside the live one](https://kiff.dev/docs/tafs-try-a-version): Try a changed taf under its own Card while the live version keeps working. Install (Face ID) or go back; an unused trial ends after 7 days.
- [Approving on your phone](https://kiff.dev/docs/tafs-approving-on-your-phone): The tafs app's approval key checks Face ID, Touch ID or the passcode itself before it signs Approve once, Extra room, issuing a Card, starting a trial or Resume; Refuse and Halt need no prompt.
- [Doors: an email address for a taf](https://kiff.dev/docs/tafs-doors): A taf can have an email address once its owner turns one on. Paired senders give work under its Card; anyone else knocks and the owner answers Do it, Pair or Ignore. Daily limits, text only.
- [Who can do what](https://kiff.dev/docs/tafs-roles): What each role (Viewer, Approver, Editor, Admin, group manager) can do with tafs: which tafs they see, Coach, new tafs, sharing, answering holds, and door conversations. No one reads another person's chats, admins included.
- [Halt and resume](https://kiff.dev/docs/tafs-halt): Stop one taf or all of them. Halted shows only once KIFF and planque confirm; a call already on its way may still arrive; resume needs Face ID and only new work runs.
- [Tasks, packs and AI use](https://kiff.dev/docs/tafs-tasks-and-packs): What counts as a task, plan tasks before packs, packs lasting 12 months, asking an admin for a pack, and AI use included up to half the plan's monthly price.

## Legal and trust

- [Security](https://kiff.dev/security)
- [Privacy](https://kiff.dev/privacy)
- [Terms](https://kiff.dev/terms)
- [Acceptable Use Policy](https://kiff.dev/acceptable-use): What customers and their agents may not do through KIFF and tafs, what KIFF may do when it is broken, and how to report abuse.
- [Data Processing Addendum](https://kiff.dev/legal/dpa)
- [Subprocessors](https://kiff.dev/subprocessors): Each company that handles personal data for KIFF, what it does, the data it touches, and where.
- [Cookie Policy](https://kiff.dev/cookies): The cookies kiff.dev sets (sign-in only; no analytics or advertising cookies), what each is for and how long it lasts.
- [Service-level agreement](https://kiff.dev/legal/sla): Paid plans' availability (99.5% a month), support response times and service credits.
- [Support](https://kiff.dev/support): How to reach a person (hello@kiff.dev), reply times, and how to delete an account in the tafs app or on the web.
- [Status](https://status.kiff.dev): Each service's state, incidents, scheduled maintenance and past incidents, served apart from KIFF.
- [Dated documentation revisions](https://kiff.dev/docs/archive): Unchanging, dated copies of the technical documentation and the security page. Each revision says when it was captured and from which commit, and never changes afterwards.
- [EU AI Act](https://kiff.dev/ai-act)

- [External approvers](https://kiff.dev/docs/external-approvers): Connect a separate decision service with bounded Card authority, run the connector, and retain human review.

## Optional

- [llms-full.txt](https://kiff.dev/llms-full.txt): The full text of the docs and whitepaper concatenated into one file, for single-fetch ingestion.

_Last updated: 2026-10-12._