Kastra evaluates every agent action against policy before execution. Unauthorized actions are blocked, redacted, or escalated for human approval.