Broken access control, caught before merge
Meet Terminus
Coding agents ship code faster than anyone can review it, and access control is what they get wrong most. Konvu drafts your authorization policies from the first scan of your repo, then a deterministic check runs every pull request against them in minutes, naming the policy that broke and the line that broke it.
Every policy has a receipt
Konvu scans your repo and drafts the rules your code already enforces, each one pointing back to the code it came from. Not a generic ruleset.
Deterministic, not probabilistic
Each policy is an executable check, not a pattern and not a prompt. Same diff, same finding, every run, in minutes.
Enforced, not suggested
A finding names the policy that broke and the diff line that broke it, so an agent can rework the code until it holds.
Fixed stays fixed
A policy is derived once and then enforced on every change after, so a rule your code holds today cannot silently stop holding tomorrow.
The threat model, compiled into rules
The Guardrail Engineer builds a semantic representation of your application's authorization model: its attack surface, trust boundaries, and who may access what. It gets there from the first scan of your repository, then compiles that model into policies bound to real routes. Your intent stops living in reviewers' heads and becomes something a machine can check.
# Derived by Konvu Guardrails. Do not edit rationale by hand.
policy: org-scoped-reads
class: broken-access-control
rule: >
Every read on Report must be scoped by the
organization_id of the session principal,
never by an identifier from request input.
binds:
- api/reports/handlers.py (get_report, list_reports)
- api/middleware/auth.py (require_org_scope)
derived_from:
boundary: org-isolation # threat model
finding: KONVU-2331
status: reproduced # exploit confirmed 2026-06-14
fixed_in: a41c2ef
enforce: [pre-commit, ci, merge-check]konvu / policies · 1 finding
Finding: org-scoped-reads
PATCH /api/reports/:id reads Report without org scope · introduced in 2f8d1c3 · derived from KONVU-2331 (reproduced)
konvu / policies · 14 policies hold
Verdict recorded on the pull request.
Required check: merging is blocked until the policies hold.
Green or red in minutes, on every PR
Konvu re-reads only the changed routes and compares what they allow against your policies, so the verdict lands on the pull request in minutes, while the author is still in it. No overnight scan, no separate queue. A finding is one concrete sentence: this subject can take this action on this resource at this route, and a policy forbids it. Agents fix and re-push in the same session.
Red at pre-commit, before the PR even opens
Via the pre-commit hook, the CLI, and MCP, an agent checks its own work before the code reaches a pull request: the check fails, it reads which policy broke, and it reworks the route until it passes. Your policies are also the intent an agent reads before it writes, so it conditions new routes correctly the first time.
▸ agent: git commit -m "add bulk report export"
konvu ✗ finding: org-scoped-reads
api/reports/export.py:42 queries Report without org scope
▸ agent: reading policy org-scoped-reads…
derived from KONVU-2331 · exploit reproduced · fixed in a41c2ef
▸ agent: scoping export query to session organization
▸ agent: git commit -m "add bulk report export"
konvu ✓ 14/14 policies hold