Your gateway
Authenticate callers, route traffic, enforce rate limits, and observe API, LLM, or MCP requests.
Keep Kong, Envoy, an MCP gateway, or your existing edge.Execution authority behind your agent gateway
Every agent action. Bound to authority.
Keep the gateway that authenticates and routes your traffic. BoundRunner controls the consequential step: the exact action, deterministic policy, independent approval when needed, narrow credentials, safe execution, and a signed outcome receipt.
- Designed behind existing gateways
- Fail-closed by default
- Self-hosted Apache-2.0 core
Live control path
request / 8f42…c9a1agent actionkubernetes.workload.deploy
production / payments-api- Identity boundagent: release-bot · digest verified12 ms
- Policy evaluatedbundle: production-guardrails / v1.4.27 ms
- Approval requiredplatform operator · immutable snapshothuman
- Credential reducednamespace: payments · expires in 4m 58sscoped
- Evidence sealedexecution settled · Ed25519 signedvalid
final decisionALLOW_WITH_CONSTRAINTS
Control actions acrossGitHubKubernetesTerraformMCPHTTPInternal APIs
A different layer
Gateways move requests. BoundRunner authorizes side effects.
BoundRunner is not a model router or another MCP catalog. It is the independent transaction boundary after intent and before a consequential provider mutation.
BoundRunner
Normalize the exact side effect, apply policy, collect independent approval, reduce authority, and settle the execution.
This is the consequential-action boundary.The provider
Receive only the action and ephemeral authority that survived the complete control path.
Repository, cluster, cloud, security tool, or internal API.The proof is one bound record: actor and deployment, normalized action hash, policy revision, approval, credential scope, idempotency state, provider outcome, and signed evidence.
One control path
Authority is a chain, not a checkbox.
Every transition stays bound to the same tenant, principal, agent deployment, action, resource, environment, and policy version.
- 01
Identity
Resolve the human, workload, agent, and deployed artifact.
- 02
Policy
Evaluate a normalized action through versioned deterministic policy.
- 03
Approval
Pause the exact high-impact action for an eligible independent reviewer.
- 04
Credential
Issue only the short-lived scope needed for the approved operation.
- 05
Evidence
Seal the decision and execution into a signed, verifiable chain.
Deterministic outcomes
See policy decide before anything executes.
These are real decision classes exercised by the BoundRunner policy suite. Caller-supplied risk never becomes authority.
Review the security modelnormalized action
kubernetes.workload.deployenvironmentproduction
agent digestverified
policy decision
REQUIRE_APPROVALProduction mutation requires an independent platform operator.
production-guardrails / v1.4.2The operating result
More useful autonomy. A smaller blast radius.
Move faster without blind trust
Let low-risk work continue automatically while production, privileged, and destructive actions hit explicit control points.
Keep credentials away from agents
Broker reduced, short-lived authority only after identity, policy, and approval checks succeed.
Answer what happened
Tie every attempted side effect to an actor, deployment, policy version, approval, credential grant, and signed evidence event.
Built for the systems agents touch
One policy boundary across code and infrastructure.
Repository operations Kubernetes workloads Internal APIs and MCP Agent and deployment identity
Paid action map
Prove the boundary before you commit to the platform.
In 10 business days, we map one exact action, its trust boundaries, approval and credential path, failure tests, and a go/no-go production-pilot plan.
Agent Action Readiness Sprint$2,500 fixedCredited toward a production pilot that starts within 30 daysRequest the sprint Already scoped? Production pilots start at $7,500.