PR #2847feat/pci-scope
AC-640 const token = getToken(req)41 return fetchAccount(token)42 }
GOVERNANCE INSIDE THE PULL REQUEST
Ship agent-written code you can defend.
Every pull request gets checked against your rules. Break one, it's blocked. Pass, and the proof writes itself.
No credit card · GitHub App · Code stays in your environment
BUILT FOR REGULATED TEAMS
- Fintech
- Healthcare
- Govtech
- Defense
- SaaS
- Enterprise
01WHAT AGENTS CAN'T DO
Your agent doesn't know your rules.
You give an agent a task and it predicts its way to an answer. Most of the time the answer is good. Sometimes it isn't, and you don't find out which one you got until someone reads it.
That's fine for a side project. It's a different thing when the output handles PHI, ships to a federal agency, or falls under a BAA you signed two years ago.
Models keep getting better, and they should. But a better model still hasn't read your BAA. Your rules live in contracts and control sets, not in training data. The only way a change honors them is if they're enforced where the change happens, on the way in, instead of reconstructed in an audit a year later.
Probabilistic agents, deterministic governance. Nothing merges without meeting your rules, and every merge leaves proof that it did.
02WHERE SLOP COMES FROM
More rules than any engineer can keep in context.
Your controls are in a PDF. Your policies are in Confluence. Your BAAs and customer security addenda are in a drive folder. None of it is near the code when the code gets written, and none of it reaches the agent writing it.
So governance becomes something you check on later. Usually in an audit.
Meanwhile your agents are making hundreds of small decisions a day. The risk isn't bad code, since bad code shows up in tests. It's code that works fine and nobody can explain. We call that slop: a decision no one made.
Every rule you're accountable to, applied at the moment the code is written. Karat keeps the answer on file for every change.
03THE GATE
A failed control blocks the merge.
Other tools report. They collect screenshots, draw a dashboard, and give you a badge for your site.
Karat refines. A control fails and the pull request does not open. It names the control, the file, the line, and the fix. What merges is the part that measured clean.
An engineer still signs off. We don't let the tool vouch for itself.
karat · pull request #482
SAWhandler.ts:42, write path, PCI scope
MISSINGscope check
STOPPEDAC-6, least privilege · fix stated in review
stopped, never failed · the fix is spelled out · one line to pass
karat · the record
RECORDac-6 · satisfied
SOURCEcommit 4f9c1a2 · handler.ts:44 · test run #4471
SIGNEDat merge · OSCAL attached
the record travels with the change · auditors read the same 3 lines
04THE RECEIPT
Then you get the receipt.
Every change that passes leaves a signed record tied to that exact commit. Not a document someone wrote in March about how things generally work. A record of what actually happened, on this line, on this day.
Your compliance team gets one place to look. Your auditor gets an export. Chasing FedRAMP, that export is a machine-readable OSCAL artifact. Chasing SOC 2 or HIPAA, it's the format your assessor asks for. When someone asks why a change shipped, the answer is already written.
05THE RULES
What we check against.
NIST 800-53
The federal control catalog FedRAMP and FISMA assessments are built on.
FedRAMP
Including OSCAL authorization packages and 20x Key Security Indicators.
NIST 800-171
Safeguarding controlled unclassified information outside federal systems.
GovRAMP
State and local authorization, built on the same NIST control baseline.
SOC 2
The audit standard enterprise customers use before buying.
HIPAA
Privacy and security of protected health information.
HITRUST
The certifiable framework health systems require from their vendors.
SOX
Change management and access controls over systems that touch financial reporting.
ISO/IEC 42001
Management-system requirements for AI, applied to the code and CI evidence.
NIST AI RMF
Risk controls for AI systems, mapped to what's observable in your pipeline.
And the ones nobody wrote a framework for.
Your BAAs, customer security addenda, and internal policies. Upload them and we extract the requirements into rules enforced the same way as everything else. It's the work your team currently redoes by hand for every enterprise account.
One control set, many frameworks.
We map a control once and each framework is a view over that map. One encryption-at-rest control can satisfy FedRAMP, HIPAA, and SOC 2 at the same time. Adding a framework later means turning it on.
06SCOPE, STATED
What we don't do.
We don't replace your agents.
Keep Claude Code, keep Cursor, keep the tools your team already has.
We don't rewrite your pipeline.
It's a GitHub App. An org owner installs it and points it at repositories. That's the migration.
We don't run your code through our AI account.
Analysis runs on your model key, in your environment. Your source doesn't leave.
We don't cover everything.
We cover the part of a control you can see in code and CI. The rest is still your job.
07WHO THIS IS FOR
This isn't for everyone.
If you're pre-revenue and nobody has asked for a SOC 2 report yet, come back later. You have better problems.
If your engineers write every line themselves and ship twice a month, human review still works. Don't fix it.
If you want a badge for your marketing site, there are companies that do that well. We're not trying to be one.
WHO IT'S FOR
Teams shipping agent-written code into regulated production.
PROOF OF WORK
Our releases go through the same check we sell.
Every Karat release carries its own records.
karat · release records
OSCALdocs/compliance/HDP-ke9/oscal-assessment-results.json
SBOMdocs/compliance/HDP-ke9/sbom.cdx.json
This control plane runs on its own harness: each delivery checks in an OSCAL assessment-results document and a CycloneDX SBOM.
You can't review your way out of this. Your agents write code all day and your team reviews for a few hours of it. Karat governs every change on the way in, so the gap never becomes your problem.
Find out where you actually stand.
Point it at one repo. You'll have your control-by-control posture in minutes.
We're pricing this with our first customers right now. Ask, and we'll let you know what we're thinking.