Stop a data export at the tool boundary.
KLA checks the destination before an agent sends customer data. An approved system receives the export. A destination outside the Data Boundary is blocked before the tool is called.
The same boundary protects a system write, an access change or an outgoing message.
Customer operations agent
Export customer records
The export tool is not called. The requested destination is outside the policy.
Connect the path you need to control.
The checkpoint sits before the side effect and sees the exact operation the agent requests.
- Route the consequential call
- The agent sends the proposed action and its context through a KLA checkpoint.
- Enforce the outcome
- Allow and warn proceed. Require approval holds the action for review. Block stops the call.
- Record what happened
- KLA links the downstream response or error to the original request, including retries and interrupted approvals.
Show where the request stopped.
Reviewers need to see both the decision and the result returned by the system that executed the action.
- Requested operation
What it contains
Agent identity, tool, parameters and correlation identifier
Question it answers
Which action reached the checkpoint
- Control outcome
What it contains
Policy version, decision, reasons and any linked approval
Question it answers
What the execution path was permitted to do
- Downstream response
What it contains
Captured result, error and timestamps
Question it answers
What the connected system returned
Schemas and examples.
Use the schemas and worked examples to review the integration and evidence requirements.
Read the policy decision modelFind the point where the action becomes consequential.
Bring one tool call and the system it changes. We find the checkpoint, the context it needs and the failure cases to test.
A 30 minute working session to scope one workflow.