From the team
Runtime Governance in Practice
Practical guides, threat models, and architecture patterns for teams building AI agents in production. Written by the engineers behind the Runta runtime.
egress.deny: * # all others
# zero-trust data exfil defense
Why Egress Allowlists Are the First Line of Defense Against Agent Data Exfiltration
When an AI agent can reach any URL, a single compromised prompt can exfiltrate your entire data warehouse. Here is how configurable egress allowlists close that gap at the runtime level.
All posts
More from the team
# per-tenant ceiling
burst.limit = 1.2x
Quota Design Patterns for Multi-Tenant AI Agent Deployments
How do you prevent one tenant's agent from starving another? This post covers CPU, memory, token, and network quota strategies that hold under concurrent load.
-> block[n].hash
# tamper-evident chain
Tamper-Evident Audit Logs: What Makes an AI Agent Action Trail Actually Immutable
Appending to a database is not immutability. This post explains hash-chaining, write-once semantics, and what a real tamper-evident audit trail requires at the storage layer.
fs.overlay(ro, /tmp/rw)
# least-privilege sandbox
Sandbox Isolation Strategies When Your AI Agent Calls Sensitive APIs
Process isolation, namespace separation, and filesystem overlays each offer different tradeoff profiles. A practical comparison for teams deploying agents that touch production data.
layer: app # inside trust
# not the same boundary
Runtime Governance vs Application-Level Guardrails: Two Different Problems
Prompt filters and content policies run inside the trust boundary. Runtime governance enforces from outside. Why this distinction matters when your agent has credentials.
allow: ["hl7.fhir.org"]
phi.egress: BLOCK
Designing Egress Allowlist Policies for AI Agents in Healthcare Environments
Healthcare platforms face strict controls on where patient-adjacent data can go. We walk through a layered egress policy approach that satisfies technical security reviews without blocking legitimate agent workflows.
net: 10MB tok: 80k
# 4-axis quota floor
The Four Resource Dimensions That Matter for AI Agent Quotas
CPU and memory are table stakes. Network bytes and LLM token consumption are where modern agents actually blow their budgets. A framework for setting and enforcing all four.
# -> credential exfil
mitigate: isolate + audit
Threat Model for AI Agent Code Execution: What Can Go Wrong and Where
A structured threat model for platform teams: prompt injection paths, credential leakage vectors, side-channel resource abuse, and the runtime controls that address each.
when, why, outcome]
# SOC 2 CC7.2 mapping
What Audit Trail Completeness Looks Like for AI Agents in SOC 2 Environments
SOC 2 auditors ask specific questions about what got accessed, by what, and when. This post maps those questions to the runtime log fields an AI agent runtime must produce.
limit + observe
+ enforce + audit
Building an AI Agent Governance Framework from First Principles
Before reaching for a product, it helps to understand what governance actually means at the runtime layer. A first-principles breakdown of what you are trying to enforce and why.
runtime.enforce: BLOCK
# finserv/healthcare req
Regulated Industries Need Runtime AI Controls, Not Just Prompt Filters
Why financial services and healthcare platform teams are finding that LLM-level safety layers alone cannot satisfy their security reviews, and what a runtime enforcement model adds.
cap_add: NET_BIND
# minCap from OS research
Lessons from OS Security for Agentic AI Sandbox Isolation
Process containment, capability-based security, and least-privilege access were solved problems in OS research. This post examines which solutions translate cleanly to AI agent runtimes and where the analogy breaks.
Ready to put governance into practice?
The runtime layer that lets your agents operate with credentials, egress controls, and an immutable audit trail in place from the first run.