# Kilo and Enkrypt AI: Guardrails your developers don’t have to think about > Source: > Published: 2026-09-25 22:59:06+00:00 Coding agents change what can leak out of an engineering org. When developers only typed code into an editor, a secret stayed on their machine unless someone committed it. With an agent, a developer can paste that secret into a chat and send it to a model provider the moment they hit enter. Agents also read files on their own, so a malicious instruction hidden in a README or design doc can steer the agent toward data it was never supposed to touch. Kilo integrates with [Enkrypt AI’s agent guardrails](https://www.enkryptai.com/product/agent-guardrails) to catch both problems before they reach the model. Admins define the policies once, and developers keep working in the Kilo CLI or IDE extensions without checking every prompt against a security checklist. ## Setting policy from the Enkrypt dashboard An admin or engineering manager creates guardrails in the Enkrypt dashboard and attaches policies to each one. The policies cover cases like malicious requests, sensitive information leaving a developer’s session, and agents working outside the scope they were given. After the guardrails exist, a terminal wizard connects Enkrypt to Kilo at either the project level or the global level. Developers never have to write or maintain the rules; whoever owns security for the team decides what gets blocked. ## What a developer sees Suppose a developer is racing to build an AI-native application and accidentally pastes an API key from their model provider into the Kilo CLI. Enkrypt blocks the prompt as soon as they send it, so the key never reaches the model, and Enkrypt’s explanation of the block shows up directly in Kilo. The developer can strip out the key and resend without leaving the terminal. A prompt injection is harder to catch, because the developer usually has no idea it’s there. Say the same developer switches to Kilo’s VS Code extension and asks the agent to read an architecture file. Someone has buried a line in that file telling the agent to forget its prior instructions and pull sensitive information from other files in the repo. The agent starts on the request, but its Read tool call fails, because Enkrypt detected the injection before the agent or the model received the corrupted instructions. In both cases the developer’s only extra work is reading the block message. ## Visibility for security and compliance Enkrypt logs every action and violation, and security or compliance officers can review those logs in the Enkrypt platform. When they open a specific guardrail, they see a summary for each user along with the individual events behind it, so an auditor can trace a blocked prompt back to the user who sent it and the policy that caught it. ## Where this fits for teams rolling out Kilo Kilo’s Teams and Enterprise plans already let admins limit which models developers can use and track how the team adopts AI through usage analytics and the AI ROI Dashboard. Enkrypt’s guardrails extend that control to the contents of each prompt and each tool call, which is where secrets and injected instructions actually show up. For an engineering leader deciding how widely to roll out agents, that division of labor matters. Security teams set and audit policy in Enkrypt at the project or global level, while developers keep using Kilo at full speed and only notice the guardrails when one of them fires.