An AI agent writes a line of code, accesses a database, or attempts to send an email. The question for a security team isn’t just what it did, but what it was about to do. Kontext, a Munich-based startup, is building a control layer that answers that question at the moment before an action executes. Its platform runs locally as a daemon, evaluating each proposed agent tool call against a stack of policy controls defined for an organization, team, or even a single repository [Scalable, October 2026]. The bet is that runtime authorization, not just post-hoc audit logs, is the missing piece for safely deploying autonomous AI workforces.
Kontext recently raised a $4 million seed round, led by 42CAP with participation from a16z CSX and High-Tech Gründerfonds (HTGF) [Kontext, September 2026]. The funding will be used to expand the development team and refine the platform, with an early focus on mid-sized and large banks and fintech companies [Tech Funding News, September 2026]. In a market crowded with AI security tools, Kontext is positioning its local, pre-execution policy engine as a fundamental governor for agentic systems.
The technical wedge: policy at runtime
Most security tools for AI operate at the API gateway or model layer, filtering inputs and outputs. Kontext inserts itself deeper, into the environment where the agent runs. The daemon evaluates actions based on identity, task context, and a security policy before granting permission [Jens Ernstberger, PhD - Kontext | LinkedIn]. This allows policies to be granular, applying to specific branches, agents, or users [Scalable, October 2026].
The platform is designed to handle agents like Claude Code or Codex that can perform actions in a software environment. It provides decision evidence, citing the specific policy rule that triggered an allow or deny, and surfaces edge cases for human review [developers.openai.com]. The goal is to move from detecting a rogue action after it happens to preventing it from being attempted in the first place.
A founder profile built for the problem
The co-founders bring a mix of deep technical and strategic experience to the challenge of securing autonomous systems. CEO Jens Ernstberger holds a PhD in system security and applied cryptography and previously worked in venture capital at a16z Crypto [Tech Funding News, September 2026]. Co-founder Michel Osswald has an electrical engineering background with a shift into cybersecurity [Startbase, September 2026]. Their stated expertise spans secure computing, cryptography, and AI systems, a combination aimed directly at the trust problems of agentic AI.
This background likely resonated with their investors. 42CAP, a Munich-based early-stage fund, led the round, while the participation of a16z’s CSX (Crypto Startup School) fund and German public investor HTGF signals a belief in both the technical approach and the European founding team.
| Founder | Role | Key Background |
|---|---|---|
| Jens Ernstberger | Co-founder & CEO | PhD in system security & applied cryptography; former a16z Crypto VC [Tech Funding News, September 2026] |
| Michel Osswald | Co-founder | Electrical engineering background moving into cybersecurity [Startbase, September 2026] |
The early market: regulated autonomy
Kontext’s reported initial beachhead is the financial services sector, where the consequences of an ungoverned AI action,whether erroneous code deployment or unauthorized data access,are severe [Tech Funding News, September 2026]. Banks and fintechs are often early adopters of security controls, providing a natural first market for a runtime authorization product.
The platform’s value proposition for these customers is a blend of compliance and operational control. By defining policies that tie agent actions to identity and task context, teams can demonstrate governance and contain risk. The local deployment model also addresses data sovereignty and latency concerns that can arise with cloud-based security services.
The competitive landscape and scale risks
Kontext is not alone in seeing the security gap around AI agents. The competitive set includes companies like Protect AI, which focuses on securing the AI supply chain, and large platform offerings like Snowflake’s Cortex AI Gateway [VentureBeat]. Other tools like OpenClaw, PromptQL, and Runlayer approach similar problems from different angles.
The differentiation for Kontext rests on the local, pre-execution enforcement model. However, this architecture introduces its own set of scaling challenges that the company will need to navigate.
- Deployment friction. Installing and maintaining a local daemon across a large, heterogeneous fleet of developer machines and cloud environments is more complex than deploying a cloud service. Kontext must ensure its agent is lightweight, resilient, and easy to manage at scale.
- Policy management overhead. The power of granular policy is also its burden. As the number of agents and contexts grows, so does the policy surface. Without intelligent tooling to simplify policy creation and audit, security teams could be overwhelmed.
- Performance latency. Inserting a policy check before every agent action adds overhead. For latency-sensitive interactive agents, even milliseconds of delay could degrade the user experience. The daemon must be exceptionally efficient to remain invisible.
From a technical standpoint, the core challenge is maintaining consistency and low latency while evaluating a complex policy graph across distributed endpoints. The system’s effectiveness will depend on its ability to make correct, unambiguous decisions without becoming a bottleneck. At scale, a misconfigured policy or a slow decision loop could inadvertently halt legitimate automation, creating a new operational headache.
The next twelve months will be a test of execution. The seed funding provides runway to build out the team and product. The key milestone to watch will be the announcement of named design partners or customers from its target financial services segment, which would validate both the product fit and the sales motion. For now, Kontext has a clear technical thesis and investor backing to pursue it. The harder work of proving that runtime authorization can become a standard layer in the AI stack is just beginning.
Sources
- [Kontext, September 2026] Kontext raises $4 million led by 42CAP | https://kontext.security/blog/kontext-raises-4m-funding
- [Tech Funding News, September 2026] Kontext raises $4M to put guardrails on AI agents for banks and fintechs | https://techfundingnews.com/kontext-4m-seed-ai-agent-security-banking-fintech/
- [Startbase, September 2026] Kontext erhält 3,5 Millionen Euro für die Kontrolle von KI-Agenten | https://www.startbase.de/news/kontext-erhaelt-35-millionen-euro-fuer-die-kontrolle-von-ki-agenten/
- [Scalable, October 2026] Kontext: $4M per la sicurezza degli agenti AI | https://www.scalablepod.it/startup/kontext/
- [Jens Ernstberger, PhD - Kontext | LinkedIn] LinkedIn Profile | https://www.linkedin.com/in/jens-ernstberger-phd-96b0ba14a/
- [developers.openai.com] OpenAI Developer Documentation (referenced for policy decision concepts) | https://platform.openai.com/docs
- [VentureBeat] Snowflake launches Cortex AI Gateway to control AI agents | https://venturebeat.com/security/snowflake-launches-cortex-ai-gateway-to-control-ai-agents-and-prevent-runaway-enterprise-costs