Kastra evaluates every Cursor Agent action against policy — blocking destructive commands and gating access to sensitive files and secrets.