runeward

The open-source governance harness for AI agents.

Put enforceable policy, human approvals, isolated execution, budgets, and signed evidence around any AI agent or subagent without replacing its model or orchestration framework.

Prove it

With Docker/Podman running:

runeward quickstart

This creates a starter policy, validates the local runtime, proves one allow and one pre-execution denial, and verifies the signed audit trail. Continue with the Quickstart, or open the dashboard:

runeward --config-dir .runeward serve

The control loop

agent request → policy → human approval when required → budgets → sandbox → signed audit event

• Policy before execution. Built-in, CEL, OPA/Rego, and signed OCI policy bundles render allow, deny, or require-approval for each action.
• Governed and isolated. The same control path wraps Docker/Podman and Kubernetes sandboxes.
• Portable proof. Export the resolved policy plus signed audit history and verify it offline.
• Practical recovery. Download the workspace or snapshot and restore it from the dashboard.
• Agent-native. Use the CLI, REST, MCP, web dashboard, Kubernetes CRDs, or included adapters.

Naming convention

The docs use familiar terms first: sandbox, policy, approvals, signed audit trail, network controls, budgets, and agent group. The original Runeward names—Citadel, Charter, Conclave, Chronicle, Perimeter, Rationing, and Cohort—remain in existing API paths and configuration fields for compatibility. See Naming.

Where to next

• Quickstart — prove allow, deny, and signed audit.
• Install — verified releases or a source build.
• Policies — write and test a security contract.
• Security model — guarantees and known limits.
• REST API — integrate an existing agent or service.
• Browser IDE — experimental in-cell code-server (and limits).
• Adapters — local Python and TypeScript SDKs.
• Agent harnessing — govern agents and delegated subagents.
• Agent groups — coordinate governed workers.
• Live escape-denial demo — stream and record a real agent, then verify isolation failures.
• Observability — metrics, logs, and telemetry.

Runeward is open source under the Apache License 2.0.