Kastra applies runtime authorization to every command Codex issues, blocking unauthorized actions before they run.