Your authorization model, in the agent's context before it writes
Your coding agent just shipped an endpoint where changing an ID lets a user read another customer's data. It passed review, and your scanners won't catch it: there is no dangerous call to flag, only a check that should exist. Konvu Guardrails puts your authorization model in the agent's context before it writes, so the check gets written instead of shipped.
Already in the agent's context
Via the CLI and MCP, an agent can read your authorization model while it works, before it drafts a route. If a route still ships without the check the model requires, the pre-commit hook catches the gap.
Every policy has a receipt
Konvu reads your repo and drafts the rules your code already enforces, each one pointing back to the code it came from rather than a generic ruleset.
Deterministic, not probabilistic
Each policy is an executable check, not a pattern and not a prompt. Same diff, same finding, every run.
The pull request is the backstop
A route that skips the pre-commit check still meets the same policy at the pull request, and the merge is blocked until it holds.
The agent reads the policy before the route ships
Coding agents write these constantly, frontier models included: they build the happy path, and the check that stops the abuse was never in their context. Via the CLI and MCP, the agent reads your authorization model while it works. If a draft still skips the check, the pre-commit hook fails, names the policy, and the agent adds it before the commit exists.
▸ agent: git commit -m "add bulk report export"
konvu ✗ finding: org-scoped-reads
api/reports/export.py:42 queries Report without org scope
▸ agent: reading policy org-scoped-reads…
derived from KONVU-2331 · exploit reproduced · fixed in a41c2ef
▸ agent: scoping export query to session organization
▸ agent: git commit -m "add bulk report export"
konvu ✓ 14/14 policies holdThe policy the agent reads is the one your code already enforces
Konvu builds it from the first scan of your repository: the attack surface, the trust boundaries, and who may access what, compiled into a policy bound to real routes. The agent queries that file, and a reviewer can open it like any other code in the repo.
# Derived by Konvu Guardrails. Do not edit rationale by hand.
policy: org-scoped-reads
class: broken-access-control
rule: >
Every read on Report must be scoped by the
organization_id of the session principal,
never by an identifier from request input.
binds:
- api/reports/handlers.py (get_report, list_reports)
- api/middleware/auth.py (require_org_scope)
derived_from:
boundary: org-isolation # threat model
finding: KONVU-2331
status: reproduced # exploit confirmed 2026-06-14
fixed_in: a41c2ef
enforce: [pre-commit, ci, merge-check]What slips through still meets the same policy
Not every agent reads the policy first, and a pre-commit hook can be skipped locally. The same policy runs again on the pull request, where a required check blocks the merge until it holds or a named approver logs an exception.
konvu / policies · 1 finding
Finding: org-scoped-reads
PATCH /api/reports/:id reads Report without org scope · introduced in 2f8d1c3 · derived from KONVU-2331 (reproduced)
konvu / policies · 14 policies hold
Verdict recorded on the pull request.
Required check: merging is blocked until the policies hold.