NULLRUNWe don't trust your agent.
We authorize the action.
NullRun decides before an action runs.
The decision is bound to the payload, and a changed payload is refused.
Agents will eventually take an action they shouldn't.
Not because the model is bad.
Because the system has no veto.
NullRun is that veto.
Bound to the payload. Decided before it executes.
What stops the agent from doing something catastrophic?
Today the answer is a prompt that says be careful.
A prompt is not a control plane.
Four principles
The rules NullRun ships under. They do not change.
Decide before execute
Authorization happens before the action lands. Reordering to observe later is not authorization.
Payload over prompt
The grant is bound to the typed action payload. User input and the system message are not part of it.
Refuse by default
When in doubt, refuse. The cost of an unexecuted action is always lower than the cost of an executed wrong one.
Audit the decision
Every block and every approval is logged — a hash-chained row, not a summary. Allowed calls are recorded in the cost trail. On Lite and Starter the audit log is not part of the plan, so there it is a plan choice rather than a control.
Who it's for
Four roles use it differently. They all read the same audit log.
Developer
Wraps the agent, ships the workflow.
A single @protect decorator that doesn't blow up under load.
Operator
On call when the workflow misbehaves.
Kill switch, approval queue, real spend — one screen.
Security
Audits the decisions, signs off on the controls.
A tamper-evident log, a typed payload, no prompt recall.
Finance
Watches the bill, owns the spend ceiling.
One counter, bound to the billing period.
What NullRun is — and what it isn't
What NullRun is, and what it is not.
Is: Runtime authorization for AI agents.
Is not: Not an LLM firewall.
Why not: An LLM firewall reads prompts. NullRun reads the action.
Is: Decides before actions execute.
Is not: Not observability-only.
Why not: Observability describes what already ran. NullRun answers before the action.
Is: Controls tools, costs, and approvals.
Is not: Not an agent framework.
Why not: A framework hosts the agent. NullRun refuses what it tries to do.
Is: Binds approvals to a typed action payload, not the prompt.
Is not: Not a guardrail library.
Why not: A guardrail nudges. NullRun refuses.
Is: Refuses the grant if the payload changes between approve and execute.
Is not: Not OAuth or an identity provider.
Why not: OAuth was designed for a client that was human.
Is: Authorizes like a bank transaction — not a policy dashboard.
Is not: Not a replacement for IAM.
Why not: A dashboard informs. NullRun controls.
Is: Creates explainable audit trails.
Is not: Not a prompt recorder.
Why not: A prompt recorder logs what the model said. NullRun logs what was decided.
Is: Works alongside your existing guardrails, policies, and observability.
Is not: Not a replacement for your agents.
Why not: The agent does the work. NullRun decides whether the work proceeds.
Six architectural choices
Each one shows up in the audit log rather than in a feature comparison table.
