tafs: AI teammates that work inside the limits you set
tafs turns a routine job you describe in a sentence into an AI teammate working under a KIFF Card: limits per action and per day, the rest held for you, every action on a signed Record.
Tagged “agent-governance”
11 posts
2026
tafs: from one sentence to a refund, inside a Card
A taf set up from one sentence on an iPad, with 50 € per refund and 100 € a day, refunded a €0.50 test payment and had a $300 one refused for its currency.
A refund desk for Shopify shops, within limits you set
How a refund desk would work for one Shopify shop, followed through a whole day: the agent handles routine refunds within the owner's limits, and asks the owner about anything bigger.
A refund desk for Shopify shops, part 2: it ran
The refund desk from part 1, run on a Shopify development store with six test customer emails: two test refunds within the limits, one held for the owner, who answered Return first.
An approved refund can still fail
KIFF records the tool’s response beside its authorization decision and brings pending approvals back into the agent’s session through MCP.
From a refund tool to an agent with a €50 Card
Build a Stripe test-mode MCP tool, connect it to KIFF, and reproduce an allowed refund, an owner approval, and a limit change with Codex.
Outside the card, the work comes home
A KIFF Card now holds an action that falls outside it for its owner, who can approve it once, change the card or reject it; we tested all three on production.
Putting KIFF between an agent and its tools
The KIFF MCP gateway checks every tool call an agent makes against its Card. Since 2 October it is set up from the dashboard, held calls are emailed to the owner, and a hold nobody answers is refused.
We gave a real agent a €50 card and asked it for refunds
A live Agno agent on Bedrock, governed by a KIFF Card through kiff-guard on production: what it was allowed, what it was refused, and what the card recorded.
Our injection defence held 100% of the attacks and 100% of the work
We gated an agent's public writes on whether the run had touched untrusted content. It stopped every attack and every legitimate post too, because it was watching the first link of a three-link chain.
The test passed. The approval did not exist.
Building a control that holds an agent's action for a human, we wrote the same bug four times: something that read as present and was not. Here is each one.