Policies (Charters)

Policies load from --config-dir or $RUNEWARD_CONFIG_DIR as .toml, .yaml/.yml or .json. Check the resolved, secret-redacted result:

runeward --config-dir examples print <charter>

Example

capabilities = ["python", "node"]

[host]
type    = "container"   # or "k8s", or "microvm" (Firecracker/libkrun)
image   = "ghcr.io/runeeward/runeward-agent:latest"
workdir = "/workspace"

[network]
default = "deny"

[[network.rule]]
verdict  = "allow"
hostname = "api.openai.com"   # supports *.wildcards

[[env]]
name  = "OPENAI_API_KEY"
value = "sk-..."   # or file = …; or op = "env://OPENAI_API_KEY"

[[policy]]
tool    = "shell"
match   = "rm -rf *"
verdict = "require-approval"

[rationing]
wall_clock   = "15m"
max_execs    = 200
max_cost_usd = 25.0

Sections

read_only = true keeps /tmp and the workspace writable. An image whose entrypoint misreads Rune Box's default sleep infinity needs command = ["/bin/sh", "-c", "sleep infinity"]. On Docker/Podman, an image that exits during startup fails creation.

Secrets

op references resolve at create:

• env://NAME: host variable.
• vault://<mount>/<path>#<field>: Vault KV v2.
• aws://<secret-id>[#json-key]: AWS Secrets Manager.
• gcp://<name>[#version]: GCP Secret Manager.
• op://<vault>/<item>/[<section>/]<field>: 1Password, read with the op CLI.

Resolution is fail-closed: an unresolvable reference aborts creation through the control plane (runeward serve, REST, MCP, agent groups, forks and snapshots). runeward enter is lenient: it skips an entry it cannot resolve with a warning naming the reason, never the value. Known secrets are redacted from the audit ledger. runeward doctor checks prerequisites without revealing values. The same references work as a [[credential]] source for the credential broker.

1Password

Support is built in: Rune Box runs op read from the official 1Password CLI (it bundles no client of its own) on the host that resolves the policy: the control plane for sandboxes, or your shell for runeward enter. Authenticate op with a service account (OP_SERVICE_ACCOUNT_TOKEN, for servers and CI), the desktop app integration (a read waits up to 60 seconds for approval), or an existing op signin session. RUNEWARD_OP_BIN points at op when it is not on PATH. Malformed references are refused before op runs, and the value is never logged. The stock control-plane image does not include op: a containerised control plane that resolves op:// needs a derived image with the CLI.

Workspace seeding

The host directory is never mounted. copy_from copies once into /workspace; later host edits do not sync. Export with:

runeward export <citadel-id> ./out

Policy engines

Set policy_engine: builtin (default, [[policy]] glob rules), cel ([[cel]]) or rego ([rego], returning data.runeward.decision).

[policy_bundle]
ref        = "oci://ghcr.io/acme/runeward-policies:v3"
verify_key = "<base64 ed25519 public key>"   # when set, a valid signature is REQUIRED

See examples/.