Bind the actor
Resolve the authenticated human or workload, registered agent, deployment, artifact digest, and tenant before policy.
Product
A runtime boundary for every agent side effect.
BoundRunner sits between agent intent and downstream execution. It keeps authorization deterministic while preserving the speed that makes agents useful.
The runtime path
Six boundaries. One immutable context.
Normalize the action
Connector-owned parsing turns provider-specific calls into a stable ActionRequest with server-owned risk and side-effect class.
Decide deterministically
Versioned OPA policy returns allow, deny, approval-required, or constrained allow under a strict deadline.
Pause the exact action
Approvals cover an immutable action hash, expire automatically, enforce separation of duties, and cannot be replayed.
Broker narrow authority
The agent never receives standing provider credentials. BoundRunner issues reduced, short-lived scope for the approved request.
Seal the evidence
Each event is canonicalized, chained, signed, tenant-isolated, exportable, and independently verifiable.
Control plane
Humans define authority.
Security and platform teams register agents, publish policies, define approval roles, connect credential providers, inspect decisions, and verify evidence.
Data plane
Agents stay inside it.
The gateway and Envoy adapter intercept actions, enforce bounds, fail closed, and forward only normalized requests that survive the complete control chain.
Built for adoption
Start with one consequential workflow.
Protect a production deployment, repository merge, Terraform apply, internal API mutation, or MCP tool call first. Expand the same identity, policy, approval, credential, and evidence model as the agent surface grows.
- Deploy in your environment
- Use your identity and credential providers
- Keep deterministic policy in source control
- Export evidence for independent verification
Bring a workflow