Every agent call goes through one gate you own.
KaaS Guard is a gateway in your cloud that every coding agent calls through. It sets a budget per team, keeps model keys in one place and removes secrets before a prompt leaves. Every call is logged.
Run by the founder, a former Head of Software Engineering.
Remove secretsMask customer dataTeam budgetsApproved models
Payments teamAgent refactors the refund service
Logged
Sent to Claude, logged
Platform teamPrompt carries a config file with a cloud key
Remove secrets
Key removed before it left
Without the ruleCloud key sent to the model provider
Support toolsAgent summarises a customer ticket
Mask customer data
Customer email and name masked
Without the ruleCustomer email sent in full
Data teamA batch job retries the same prompt all night
Team budgets
Held at the team budget. The lead can raise it.
Without the ruleKept spending until the invoice arrived
Mobile teamAn editor plugin calls a model nobody approved
Approved models
Blocked: not on the approved list
Without the ruleCode sent to a provider nobody reviewed
Checkout teamAgent writes tests for saved cards
Logged
Sent to Claude, logged
Why agent use gets out of control
Nobody decided to lose track. It happens one licence and one key at a time. You can fix it without first finding every key.
Keys live on laptops. Each team signed up on its own, so nobody can say which keys exist or who can switch them off.
Prompts carry more than code. Config files, tokens and customer records ride along in context and leave your cloud with the prompt.
Spend shows up a month late. It arrives at month end as one line, with no way to see which team or which job ran it up.
KaaS Guard sends every agent call through one gateway in your account, where keys, rules and budgets sit together.
One log, read by the people who answer for it
Every call that passes the gate is written down once. Each role reads the part it owns.
The gateway log
- Payments teamSent
- Platform teamKey removed
- Support toolsData masked
- Data teamHeld at budget
- Mobile teamModel blocked
- Checkout teamSent
Security leads see what was removed or blocked.
From which team, and why.
Finance sees spend as it happens.
By team and by model, every day of the month.
Team leads raise their own budget.
They see what used it and switch the limit themselves.
Engineers keep their tools.
Their agents point at the gateway instead of the provider.
Every agent call passes one gate in your cloud.
Security, finance and each team lead read the same log.
How KaaS Guard goes in
We install the gate with your team, then hand it over. The gateway and every rule in it are yours.
We map every agent, key and model in use today, team by team.
We set budgets with each team lead and agree the approved list with security.
Teams move onto the gateway one at a time, keeping the tools they already use.
“You work with the person who does the work. No handoff, no juniors, no account manager.”
Paramanantham HarrisonFounder, KaaS.team
- Former Head of Software Engineering
- 14 years building production software
Questions teams ask before they book
What is an AI gateway?
An AI gateway is one service that every agent calls instead of calling a model provider directly. KaaS Guard runs it in your cloud, so rules, keys, budgets and the log sit in one place you own.
What is LLM observability?
LLM observability means you can see every model call: who made it, which model answered and what happened. KaaS Guard logs every call through the gateway, by team and model.
Can we host the AI coding setup ourselves?
Yes. KaaS Guard runs in your own cloud account and routes to the models on your approved list, Claude included.
How do you keep secrets out of prompts?
The gateway checks each prompt before it leaves, removes keys and tokens, and masks customer data such as emails and card numbers. The log shows what it removed.
What happens when a team reaches its budget?
Calls hold at the limit and the team lead sees why. The lead can raise it, so nobody waits on us.
Do engineers have to change their tools?
No. Their agents point at the gateway instead of the provider. We move one team at a time and check nothing breaks.
Who is KaaS Guard for?
Teams that use coding agents with their own keys, where security asks what leaves your cloud and nobody can answer, and where agent spend is one line on the bill.
Who is KaaS Guard not for?
A company where one team uses one tool and its admin page covers you, or where no coding agents are in use yet.
What stays with us?
gateway/, the gateway running in your cloud account. gateway/rules.yaml, redaction, masking and the approved model list. gateway/budgets.yaml, each team’s budget and who can raise it. gateway/changing-a-rule.md, how your team changes any of it.
How does it fit with the other KaaS solutions?
KaaS Guard covers every stage of the five KaaS solutions. See how all five fit together.
What is fixed before we start
Fit check first. If we're not the right team, we'll say so on the call.
You get a written scope and a fixed quote before anything starts.
Everything we install stays in your cloud and your repo when we finish.
The Care Plan is optional, and stopping it changes nothing that already works.
Bring us the bottleneck.
A 30 minute call with the founder about where work is stuck.
- Spec
- Build
- Review
- Release
- Where work is stuck
- Spec, build, review or release: wherever changes wait longest.
- What exists today
- The AI tools your teams use and the rules around them, if any.
- What the next quarter needs
- The launch or deadline the work has to hit.
- 1
Call
We find where the work waits and whether we can help.
- 2
Fixed scope
You get a written scope and a fixed quote before anything starts.
- 3
Kickoff
Work starts with your product and engineering leads.
If we're not the right fit, we'll say so.
Pick a time
Open the calendar and choose any free slot. You get an invite with a video link.