Startup Launches With Funding to Govern AI Agents in Real Time
Kontext Security has publicly launched with $4 million in seed funding to give organizations visibility and control over what AI agents actually do once they are running in production. The Munich, Germany-based startup's runtime enforcement platform sits between AI agents and the systems and tools they access, evaluating every action against security policy at the moment it happens rather than relying solely on permissions granted before a task begins.
The round was led by 42CAP, with participation from a16z CSX and High-Tech Gründerfonds (HTGF). Kontext was co-founded by Jens Ernstberger, who serves as CEO, and Michel Osswald, with backgrounds spanning secure computing, applied cryptography, and AI systems.
Details
| Attribute | Value |
|---|---|
| Company | Kontext Security |
| Headquarters | Munich, Germany |
| Funding announced | $4 million (seed) |
| Lead investor | 42CAP |
| Participating investors | a16z CSX, High-Tech Gründerfonds (HTGF) |
| Co-founders | Jens Ernstberger (CEO), Michel Osswald |
| Product category | Runtime enforcement / control platform for AI agents |
| Announcement date | September 24, 2026 |
What the Platform Does
The Runtime Control Gap
Kontext's pitch centers on a gap the company says traditional identity and access management (IAM) tools were never built to close. Conventional IAM establishes what an agent is permitted to do before a task starts — but agentic AI systems chain together tool calls, generate their own next steps, and can drift into actions no one explicitly authorized, even while using approved credentials and approved tools.
As Ernstberger put it: "An AI agent can be properly authenticated, use an approved tool, and still take an action no one authorized. As agents move from generating text to operating software, companies need a control point at the moment of action. Kontext connects identity with task context and policy to decide what an agent is allowed to do before it happens."
How Enforcement Works
Deployed inline between agents and the resources they touch, Kontext evaluates each requested action against four factors:
- Agent identity — which agent, and under what credentials, is making the request
- Assigned task — the scope of work the agent was actually given
- Target resource — the specific system, repository, or data the action would affect
- Requested action — the precise operation being attempted
The company's example is a coding agent assigned to fix a bug: it might legitimately need read access to source code, but Kontext's policy layer can allow that read while blocking the same agent from exfiltrating the repository to an external service or modifying unrelated infrastructure — actions a static permission grant would not distinguish from the sanctioned task.
Observation Mode, Then Enforcement
Kontext is designed for a staged rollout. Organizations first deploy it in observation mode, where it records agent behavior across the environment without blocking anything, giving security teams a baseline of what their agents actually do. Once teams are confident in that baseline, they can switch on enforcement mode, where Kontext blocks policy-violating actions before execution rather than logging them after the fact. Every decision — what was attempted, whether it was approved or denied, and which policy produced that outcome — is captured in an audit trail.
Impact Assessment
| Impact Area | Description |
|---|---|
| Agentic AI adoption | Targets organizations moving AI agents from pilots into production, where unsupervised tool-calling creates new operational risk |
| Traditional IAM tooling | Positions runtime, action-level enforcement as a complement to (not a replacement for) existing identity and access management |
| Incident response | Structured audit trail of agent decisions could shorten investigation time when an agent takes an unexpected action |
| Compliance and audit | Real-time policy enforcement plus decision logging may help satisfy emerging governance requirements around autonomous AI systems |
| Competitive landscape | Enters a crowded and fast-moving AI-agent-security segment alongside other recently funded runtime and identity-focused startups |
Recommendations
For Security Teams
- Inventory active AI agents across the environment, including their assigned tasks, credentials, and the systems they can reach
- Start with observation-style monitoring before enforcing hard blocks, to avoid disrupting legitimate agent workflows on day one
- Treat agent actions as a distinct log source from human user activity, since the volume and pace of agent-initiated requests differ substantially
For AI/Platform Engineering Teams
- Scope agent permissions to task, not just identity — a valid credential and an approved tool are not the same as an authorized action
- Design agents with the assumption that a runtime control point may deny an action, and build graceful handling for denied requests
- Document expected agent behavior so anomalies are easier to distinguish from legitimate, if unusual, task execution
For Organizations Evaluating Agentic AI
- Budget for runtime governance alongside agent deployment, not as an afterthought once agents are already in production
- Ask vendors how "authorized" is defined — at authentication time, at tool-approval time, or at the moment of action — before assuming existing IAM coverage is sufficient
- Weigh newer, seed-stage vendors carefully against roadmap maturity and integration effort for production environments
Key Takeaways
- Kontext Security launched publicly with $4 million in seed funding led by 42CAP, with a16z CSX and HTGF also participating.
- The Munich-based startup, co-founded by Jens Ernstberger and Michel Osswald, builds a runtime enforcement platform for AI agents.
- The platform evaluates agent actions in real time based on identity, assigned task, target resource, and requested action — not just pre-granted permissions.
- Kontext argues traditional IAM cannot stop an authenticated agent, using an approved tool, from taking an unauthorized action mid-task.
- Deployment follows a two-stage model: observation mode to baseline behavior, then enforcement mode to block policy violations before execution, all with an audit trail.
- The launch reflects growing investor and enterprise interest in agentic AI security as organizations move agents from experimentation into production systems.