Kynara enforces policy-based access control for AI agents operating on the factory floor, supply chain systems, and industrial IoT — requiring human approval before any action that could halt a production line or affect product quality.
// Allow reads always
{ "display_name": "Allow sensor reads",
"effect": "allow", "priority": 100,
"actions": ["plc.read", "scada.read", "sensor.read"],
"condition": {} }
// Block writes outside maintenance window (Sat/Sun 00:00-06:00)
{ "display_name": "Block production writes outside change window",
"effect": "deny", "priority": 200,
"actions": ["plc.write", "scada.write", "line.configure"],
"condition": {
"op": "not",
"args": [{ "op": "time_between",
"args": ["ctx.context.time", "00:00", "06:00"] }]
}}
// Require engineer approval for writes inside window
{ "display_name": "Require approval for production writes",
"effect": "require_approval", "priority": 300,
"actions": ["plc.write", "scada.write", "line.configure"],
"condition": {} }
| Standard / Requirement | Kynara Feature | Status |
|---|---|---|
| ISO 9001 — Record of changes to production processes | Hash-chained audit log of every agent action with actor and context | Built-in |
| IEC 62443 — Access control for OT/ICS systems | RBAC + ABAC with IP-range and facility conditions | Built-in |
| Change management — human approval for critical changes | require_approval as first-class policy outcome | Built-in |
| Maintenance window enforcement | time_between condition operator | Built-in |
| Incident investigation — full action history | Audit log with event replay and CSV export | Built-in |
| Anomaly detection — agent behavioral drift | Z-score deny-rate alerting, auto-revocation | Built-in |
Free plan to get started. Enterprise plans include dedicated deployment and custom SLA.