Overview

Try it

With Docker, OrbStack or Podman running:

runeward quickstart

This creates a starter policy, validates the local runtime, proves one allow and one pre-execution denial, and verifies the signed audit trail. See Install and the Quickstart.

The control loop

agent request → policy → human approval when required → budgets → sandbox → signed audit event

Why governance lives outside the agent

Training and prompting are soft controls: probabilistic, easy to talk around, and allow-by-default. A control the operator forgot to ask for is simply absent.

Rune Box makes the environment enforce the rules. The agent reaches the shell, files, network and code execution only through a governed path, driven by a policy (Charter): a declarative, deny-by-default contract written once by the security owner and enforced on every action. The agent's cooperation is never part of the security model.

For example, these rules deny a database drop and pause terraform apply for a human:

[[policy]]
tool    = "shell"
match   = "*drop database*"
verdict = "deny"
reason  = "production data is off-limits to agents"

[[policy]]
tool    = "shell"
match   = "terraform apply*"
verdict = "require-approval"   # pauses for a human to approve, in-band

Evidence for auditors

The export embeds the public key, so anyone can verify it offline. If a record is altered or dropped, verification fails.

# Export from a running control plane, then verify offline
curl -s localhost:8080/v1/chronicle/export > transcript.json
runeward chronicle verify transcript.json

curl -s localhost:8080/v1/chronicle/verify          # verify the live ledger
curl -s localhost:8080/v1/citadels/$SB/chronicle    # one sandbox's events and verdicts

chronicle verify checks only a bundle's hash chain and signatures. To tie the trail to the policy in force, export an evidence package (runeward evidence export <charter>): runeward evidence verify also checks the embedded policy digest. An evidence package holds a digest of the resolved, secret-redacted policy and the signed event bundle. A bare bundle, for example from GET /v1/chronicle/export, has no policy in it. See Quickstart.

The policy is the documented control, and the verified audit trail is the evidence. Rune Box does not certify you.

Limits

• Rune Box governs mediated actions only: what the agent does through its sandbox, tools, egress and file operations. It is not model alignment. It cannot police reasoning, or an action it never mediates, such as an agent handed live production credentials and a network path you explicitly allowlisted.
• It is a control plane. Someone still writes the policy and staffs the approvals inbox.
• It covers execution governance, not identity. Who an agent is and what it may reach across trust boundaries belongs to identity systems such as OAuth/OIDC, SPIFFE/WIMSE and AAuth. The two compose.
• Known gap: Rune Box authenticates its own API with bearer tokens and injects outbound secrets into the sandbox. Proof-of-possession identity is tracked in the roadmap.

See Security for what is and is not in scope.

Naming convention

These docs use the familiar term first. The Rune Box names stay in API paths, CLI commands, configuration fields and Kubernetes kinds for compatibility, and are not being removed in a breaking change.

An agent group (Cohort) is a group of peer workers. It is not a subagent, which is a child delegated by a parent agent in an external orchestrator.

These technical names are unchanged by the rename:

• binaries and commands: runeward, runeward-egress, runeward-supervisor, runeward-browser;
• environment variables: RUNEWARD_*;
• Kubernetes CRD group: runeward.dev;
• packages and images: runeward-* crates, runeward (PyPI), @runeward/sdk (npm), ghcr.io/runeeward/runeward*;
• file paths such as .runeward/.

Rune Box is open source under the Apache License 2.0.