Rune BoxLive
Check every action before it executes
A Charter decides allow, deny or require-approval for shell, code, file and network actions using glob rules, CEL, OPA/Rego or signed OCI policy bundles.
Use case · Rune Box
Govern autonomous agents in pipelines and automation.
When an agent runs in CI, on a server or in Kubernetes, nobody is watching the terminal. Rune Box moves the rules outside the agent, into a layer it cannot prompt its way past.
The problem
What goes wrong today
Unattended agents work from instructions, and instructions are soft controls: anything not forbidden is implicitly allowed, and the control someone forgot to ask for is the one that fails.
A container limits CPU and memory but still executes whatever the agent requests, leaves the network open unless configured otherwise, and produces logs rather than evidence.
How Runewrd Labs helps
What each product does here, and its status.
Rune BoxLive
Test policy in CI like code
runeward policy test asserts expected verdicts, so a policy change that would let a destructive command through fails the pipeline before it reaches an agent.
Rune BoxLive
Bound what a run can consume
Rationing sets wall-clock, execution-count and egress-request limits, retry-loop detection, and token and cost caps once usage is reported.
Rune BoxLive
Deny egress by default
Only allowlisted hostnames are reachable, with strict L3 enforcement on Kubernetes, where sandboxes can also be declared as Citadel custom resources.
Rune BoxLive
Hand off verifiable evidence
Every governed action becomes an append-only, hash-chained, Ed25519-signed event. Export it, verify it anywhere, and let policy learn propose exact rules for a human to review.
Rune Box
Governed browser actions
Browser automation is off by default; enable it only in a trusted deployment after reviewing the security model.
In the evidence
The exact identifiers you will see.
Names as they appear in Runeward Labs findings, rules and commands, so you can match this page to real output.
| Identifier | Source | What it means | Status |
|---|---|---|---|
require-approval | Charter verdict | Pauses a risky action until an attributed human decision is recorded. | Live |
runeward policy test | CLI | Asserts that a tool and action produce the expected verdict, for use in CI. | Live |
[rationing] | Charter section | wall_clock, max_execs, egress_requests, loop detection, max_tokens and max_cost_usd. | Live |
runeward evidence verify | CLI | Independently verifies an exported run’s policy and audit chain. | Live |
runeward policy learn | CLI | Proposes exact rules from verified evidence; never edits policy automatically. | Live |
Citadel | Kubernetes CRD | Declarative sandboxes reconciled by the Runeward controller. | Live |
# fail the pipeline if a destructive command is not denied runeward policy test quickstart \ --case 'tool=shell,action=rm -rf /,expect=deny' # after a run: export and verify the signed evidence runeward evidence export quickstart -o run.json runeward evidence verify run.json
Honest limitations
What this does not cover yet
A scan finding shows exposure. A sensor or hook finding shows what an agent attempted, or what was blocked. Neither proves a compromise, and a block decision without a report from the enforcing component doesn’t prove the action was stopped.
- Per-action policy applies to tool calls routed through the control plane (REST, MCP, dashboard and SDKs). An interactive terminal or a process already running inside a sandbox gets isolation, network and resource controls and recording, but its individual commands are not intercepted.
- Token and cost caps are enforced once the agent harness reports usage to the API.
- Rune Box is pre-1.0. Browser automation and the browser IDE are disabled by default.
- This use case relies on Rune Box. Rune Guard is built for employee endpoints, not CI runners.
Your agents already have access. Ward off the risks.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.