Governance

Isolate agent execution

Agent filesystem and terminal tools can run inside isolated containers. Choose disabled, local Docker, or Cloud Run sandbox modes with configurable resource and network restrictions.

• Disabled, local, and cloud_run modes
• Configurable CPU, memory, and network access
• Per-execution temp directories

1. SecurityJWT auth, bcrypt hashing, webhook signature verification, and service-token guards.
2. AuditAppend-only audit events for auth, vault, integrations, triggers, and workspaces.
3. BudgetMonthly token budgets with hard-stop and warning thresholds, enforced pre-execution.
4. Approval gatesPause any workflow at an approval node until someone signs off, or the request expires.
5. Secret rotationOpt-inRotation policies with due dates, verification against the real provider, and a grace window where old and new both work.