Kontext has raised $4M for software that checks what an AI agent is allowed to do once it is working inside a business. Each action the agent asks for is intercepted and tested against security policy, with three things weighed: the task it was handed, the resource it wants and the agent’s identity.
Picture a coding agent told to fix a flaw. Reading the repository is fair game. Mailing that source to an outside party, or spending the same login on unrelated systems, is not, however valid the credentials look.
Buyers can begin in a monitoring setting, seeing which requests a rule would have stopped without halting anyone’s work. Switch it to enforcing and off-policy requests never leave the gate, with an audit trail behind every call.
Kontext’s co-founder and chief executive, Jens Ernstberger, did his doctorate in cryptography and computer security at the Technical University of Munich, and built the company with Michel Osswald after that. He keeps the problem centered on intent: “can be properly authenticated, use an approved tool, and still take an action no one authorized” is how he sums up an agent that clears every gate while nobody has approved the step it is about to take.
42CAP led the round, with a16z CSX and High-Tech Gründerfonds participating. Individual developers get the software at no charge. Paid team subscriptions begin at $149 a month. Today it works alongside coding agents, among them Anthropic’s Claude Code and OpenAI’s Codex, checking every request they make before anything is allowed to execute.
The money goes to engineering. The wider bet is that agent permissions become their own layer of enterprise security, sitting between credentials that pass and actions nobody approved.
