Guardrails to control what every agent can do
Trusted by teams running mission-critical operations.
How every agent stays contained
Nothing inside the sandbox is trusted to enforce security. Each layer works on its own, so a poisoned prompt has to beat all of them.
A sandbox for every session
Every agent works on its own machine: a microVM or a gVisor-sandboxed container. Nothing is shared between sessions.
Real keys never enter the sandbox
The agent only ever holds a stub. A credential proxy outside the sandbox attaches the real key to approved requests, so a hijacked run has no key to steal.
Nowhere to send your data
Agents reach only the hosts and IP ranges you approve. All other outbound traffic is blocked at the edge of the sandbox.
A check on every tool call
Hooks run your own checks before and after each tool call, with a deterministic script or a model. Command deny lists always win.
A person approves what matters
Sensitive actions pause for a human sign-off from the dashboard or Slack before anything happens.
Every step on record
Every run is stored with its prompt, steps, tools, approvals, and cost. Searchable and exportable.
Diagrams are illustrative.
Rules your agents can't talk their way around
Guardrails are configuration, not prompts. Set them once per organization, team, or agent.
RBAC for humans and agents
Roles and groups for your team. Agents get their own identity, scoped API keys, and a list of who can call them.
Budgets and spend limits
Cap cost per session and spend per user per day or month. Hard limits block, soft limits warn.
Command allow and deny lists
Allow, ask, or deny shell commands by pattern. Anything unmatched follows your default.
Deterministic scripts
Enforce rules with plain bash scripts, not prompts. The same input gets the same verdict every time.
Prompt injection
Built for agents that read untrusted content
Agents read emails, tickets, and logs that anyone can write. A poisoned instruction has nothing to grab and nowhere to go.
Content is evidence, not instructions
Skills tell agents to treat emails, tickets, logs, and web pages as data to report on.
Nothing to steal, nowhere to send it
Real keys stay in the proxy, and egress allowlists block every host you have not approved.
Least privilege, then approval
Read-only credentials and deny lists limit what a poisoned prompt can reach. Real actions still need a human.
Built to stay up
A payout investigation shouldn’t stop because one cloud has a bad day. Sessions spread across providers and move when one degrades.
Multi-cloud sandbox redundancy
Run on E2B, Google Kubernetes Engine, or AWS Lambda microVMs, and switch providers if one has an issue.
Multi-tenant by design
Every record is scoped to your organization. Bring your own AWS account to keep execution in your cloud.
Your data stays yours
We never train on your data. Purge session data on the retention schedule you set.
The same agents can defend you
A squad of agents watches your activity and infrastructure logs, investigates threats, and recommends a response for your team to approve. We run this on our own platform.
SOC 2 compliant
Independently audited against the AICPA Trust Services Criteria. Encrypted at rest and in transit.
Request the reportSelf-host Runtime
For organizations that cannot send code or execution outside their own infrastructure. Run Runtime inside your VPC, on your compute.
Talk to the teamYour cloud, your rules
Run the entire Runtime control plane on your own infrastructure. Nothing leaves your network.
Bring your own sandbox
Already run Firecracker, gVisor, or a custom execution layer? Runtime can use it instead of ours.