Rune Box¶

An environment where your agent can roam freely but with receipts.

Rune Box, by Runeward, is the open-source governance harness for AI agents.

Put enforceable policy, human approvals, isolated execution, budgets, and signed evidence around any AI agent or subagent without replacing its model or orchestration framework.

Prove it¶

With Docker, OrbStack, or Podman running:

runeward quickstart

This creates a starter policy, validates the local runtime, proves one allow and one pre-execution denial, and verifies the signed audit trail. Continue with the Quickstart, or open the dashboard:

runeward --config-dir .runeward serve

The control loop¶

agent request → policy → human approval when required → budgets → sandbox → signed audit event

Policy before execution. Built-in, CEL, OPA/Rego, and signed OCI policy bundles render allow, deny, or require-approval for each action.
Governed and isolated. The same control path wraps Docker/Podman and Kubernetes sandboxes.
Portable proof. Export the resolved policy plus signed audit history and verify it offline.
Practical recovery. Download the workspace or snapshot and restore it from the dashboard.
Agent-native. Use the CLI, REST, MCP, web dashboard, Kubernetes CRDs, or included adapters.
Confined inside. An in-sandbox supervisor applies Landlock, seccomp and a dropped identity; the egress proxy brokers credentials so the agent never holds the real secret. See Isolation.
Work that persists. Persistent workspaces, forks, agent turns, Cohort memory and schedules. See Workspaces and context.

Naming convention¶

The docs use familiar terms first: sandbox, policy, approvals, signed audit trail, network controls, budgets, agent group, and signed policy bundle. The original Rune Box names—Citadel, Charter, Conclave, Chronicle, Perimeter, Rationing, Cohort, and Archive—remain in existing API paths, CLI commands, and configuration fields for compatibility. See Naming.

Where to next¶

Quickstart — prove allow, deny, and signed audit.
Install — verified releases or a source build.
Policies — write and test a security contract.
Security model — guarantees and known limits.
REST API — integrate an existing agent or service.
Browser IDE — experimental code-server inside the environment (and limits).
Adapters — local Python and TypeScript SDKs.
Agent harnessing — govern agents and delegated subagents.
Agent groups — coordinate governed workers.
Live escape-denial demo — stream and record a real agent, then verify isolation failures.
Observability — metrics, logs, and telemetry.

Rune Box is open source under the Apache License 2.0.