Castor introduces a secure execution layer for LLM agents that structurally limits capabilities and prevents runaway operations through a kernel-based syscall system.

Current agent frameworks lack execution controls, allowing agents to execute any tool call without limits or structural safeguards against dangerous operations like filesystem deletion

Castor routes all tool calls through a kernel as syscalls, making capability limits and approval gates structural requirements rather than advisory guidelines

The system uses budget-based execution: operations auto-run within budget limits, but the kernel stops the agent when budget is exceeded, allowing human intervention

Addresses critical gaps in existing frameworks including lack of process models and inability to pause/resume agents mid-execution when failures occur