Governance

Isolateagentexecution

Run tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.

Agent filesystem and terminal tools can run inside isolated containers. Choose disabled, local Docker, or Cloud Run sandbox modes with configurable resource and network restrictions.

Disabled, local, and cloud_run modes
Configurable CPU, memory, and network access
Per-execution temp directories

All features Get started

Related in Governance

Security

JWT auth, bcrypt hashing, webhook signature verification, and service-token guards.

Audit

Append-only audit events for auth, vault, integrations, triggers, and workspaces.

Budget

Monthly token budgets with hard-stop and warning thresholds, enforced pre-execution.

Approval gates

Pause any workflow at an approval node until someone signs off — or the request expires.

Secret rotation

Rotation policies with due dates, verification against the real provider, and a grace window where old and new both work.