Runeward Review 2026

Governed execution cells for AI agents: declarative profiles provision isolated Docker or Kubernetes sandboxes with deny-by-default egress, policy gates, human approvals, guardrails, and a tamper-evident audit ledger.

Runeward is an open-source governance layer for running AI agents that execute shell commands, edit files, install packages, and hit the network. Its premise is that raw isolation — jailing the agent in a box — is table stakes; the real risk management happens in the governance layer around the box, enforced outside the model instead of hoping the model was trained to behave. Declarative profiles act as a security contract: everything you do not explicitly grant is denied by default, so the blast radius is always explicit. Every action, whether it arrives via REST, the web dashboard, the CLI, or MCP, flows through one path — policy evaluation (builtin rules, CEL, or OPA-Rego), an approval gate, guardrails, backend execution, and an audit ledger. That ledger is append-only, hash-chained, and ed25519-signed, exporting as an independently verifiable transcript. Per-action allow/deny/require-approval verdicts pause risky operations for a human operator, and hard guardrails cap wall-clock time, exec counts, egress requests, and token/spend budgets, with retry-loop detection. MCP support is first-class: runeward is agent-native and driven over REST, MCP, CLI, and dashboard, with adapters for LangChain, CrewAI, LlamaIndex, OpenAI Agents SDK, Strands, Vercel AI SDK, and LangChain.js. Backends are pluggable — Docker/Podman for zero-setup laptop use, or Kubernetes with strict L3 egress, CRDs, an admission webhook, and PSA plus NetworkPolicy multi-tenancy for production fleets. It also supports multi-agent fleets with an atomic task board, bearer-token auth with multi-principal RBAC, Prometheus-style metrics, and cosign-signed releases with SBOMs. Apache-2.0 licensed with a one-line installer.