# NullRun

> Runtime authorization for AI agents. NullRun caps spend, blocks unsafe tool calls, requires human approval, and records every block and approval.

Last updated: 2026-10-26. Expanded version of this file: [llms-full.txt](https://nullrun.io/llms-full.txt). The same facts, section-numbered, as HTML: [llm-info](https://nullrun.io/llm-info).

NullRun sits between your agent and the outside world. Decisions are bound to the action payload, not the prompt. The application continues to call the upstream model and tools directly — on an LLM call NullRun receives the model, the token estimate and the policy signals, never the prompt and never the completion; a protected tool call additionally sends its arguments, with values whose names look like secrets masked.

Trust surfaces, in one line each: [Security](https://nullrun.io/security) — the controls: encryption, fail-closed budget enforcement, hash-chained audit log, geo-block, key rotation, backups. [Trust](https://nullrun.io/trust) — the framework coverage map (Covered / Out of scope) and the operational commitments. [Compare](https://nullrun.io/compare) — NullRun against Microsoft AGT, APort, Credo AI, Straiker, Isonapse, Portkey, Noma Security and Prisma / Palo Alto, scored on gate, approval, spend and audit.

## Docs

- [Engineering docs](https://docs.nullrun.io/): the canonical reference. [HTTP API](https://docs.nullrun.io/reference/http-api/) (`POST /api/v1/gate`, `POST /api/v1/execute`, `POST /api/v1/track`, `POST /api/v1/track/batch`, org-scoped `GET /api/v1/orgs/{org_id}/usage`), [SDK API](https://docs.nullrun.io/reference/sdk-api/), [error catalog](https://docs.nullrun.io/reference/errors/), [decorators](https://docs.nullrun.io/reference/decorators/), [LLM tool catalog](https://docs.nullrun.io/reference/llm-tool-catalog/).
- [Quick start](https://nullrun.io/docs): install the Python SDK (`pip install nullrun`), export `NULLRUN_API_KEY`, wrap a function with `@nullrun.protect`, and get a runtime decision per call. Typed impact travels as a `BusinessImpact` envelope on the wire — the SDK has no `@sensitive` decorator.
- [HTTP quick start](https://nullrun.io/docs/api): the same install → key → wrap path for readers who came for the API surface.
- [Examples](https://nullrun.io/docs/examples): hard cost caps, sensitive-tool marking, one budget across many agents, streaming with cost attribution, manual cost tracking, CI/CD wiring.
- [Concepts](https://docs.nullrun.io/concepts/policies/): how policies, budgets, approvals, sensitive tools, MCP servers, API keys, alerts and the circuit breaker actually behave.

## Pricing

- [Pricing](https://nullrun.io/pricing): Lite (free), Starter, Growth, Scale, and Enterprise — workflow caps, decision limits, seat counts, and the per-tier feature matrix.
- [Enterprise](https://nullrun.io/pricing): contact-sales SKU with every cap unlimited (workflows, decisions, policies, approval rules, API keys, seats) and custom terms.
- Entitlements by tier: human approvals, RBAC and the full audit log start at Growth; Lite and Starter ship budget caps, tool block policies, rate limits and decision history only (3 and 7 days). Single sign-on (SSO) and VPC deployment are not available on any plan.
- New Lite workspaces run on full Scale quotas for 14 days, then fall back to Lite limits.

## Product

- [About NullRun](https://nullrun.io/about): what NullRun is, what it isn't, and the four gaps in existing control planes that make it necessary.
- [Use cases](https://nullrun.io/use-cases): 16 production scenarios grouped by irreversible actions, policy boundary, runtime reliability, and decision evidence.
- [Compare](https://nullrun.io/compare): NullRun vs. Microsoft AGT, APort, Credo AI, Straiker, Isonapse, Portkey, Noma Security, and Prisma / Palo Alto — scored on gate, approval, spend, and audit.
- [FAQ](https://nullrun.io/faq): 19 short answers on pricing, integrations, policies, audit, permissions, and the fail-closed contract.
- [Security](https://nullrun.io/security): AES-256 at rest, TLS 1.3 in transit, fail-closed budget enforcement, hash-chained audit log, fortress geo-block, sanctions screening, two-phase API key rotation, daily database backups with an automated restore test (worst-case loss = one day).
- [Trust](https://nullrun.io/trust): framework coverage map (Covered / Out of scope) and operational commitments — encryption, sub-processors, retention, evidence pack.
- [Roadmap](https://nullrun.io/roadmap): planned capabilities and current development phase.

## Blog

Engineering essays on runtime authorization — each one argues a design, shows the code, and states where NullRun implements it.

- [Intercepting tool calls without patching framework internals](https://nullrun.io/blog/intercept-tool-calls-before-execution) and [Treat an agent as two systems joined by a seam](https://nullrun.io/blog/the-seam-between-model-and-execution): where the gate belongs, and why it is downstream of reasoning and upstream of the side effect.
- [An agent budget is an authorization decision](https://nullrun.io/blog/agent-budget-is-a-permission-not-a-limit) and [Atomic budget reservation in Redis Lua: pattern and failure modes](https://nullrun.io/blog/atomic-budget-reservation-redis-lua): reserving against the projected future, and the four ways an apparently-correct script still leaks money.
- [Binding a human approval to the exact payload it authorized](https://nullrun.io/blog/human-approval-is-not-authorization) and [Reducing approval fatigue without removing the control](https://nullrun.io/blog/reducing-hitl-approval-fatigue): binding a grant to a hash of the action payload, and designing rules an operator can decide on.
- [Six enforcement paths, six declared defaults](https://nullrun.io/blog/fail-closed-is-not-a-single-switch): six places where a fail-closed design quietly becomes fail-open, and the test that catches each.
- [Agents cannot widen their own authority](https://nullrun.io/blog/authority-over-its-own-authority) and [Operator control lives in state the agent cannot reach](https://nullrun.io/blog/operator-control-must-be-external-state): keeping operator authority outside the thing it governs.
- [How to build an audit trail for AI agent tool calls that survives an auditor](https://nullrun.io/blog/audit-trail-for-ai-agent-tool-calls) and [An unknown outcome is its own state](https://nullrun.io/blog/unknown-outcome-is-not-a-failure-state): evidence that a compliance reviewer can actually read.

Full index, 23 posts: https://nullrun.io/blog · feed: https://nullrun.io/blog/rss.xml

## Legal

- [Terms of Service](https://nullrun.io/terms): governing law Republic of Armenia, arbitration administered by the Arbitration and Mediation Center of Armenia (AMCA), ineligible-jurisdictions list.
- [Privacy Policy](https://nullrun.io/privacy): controller identification (Anatolii Maltsev, Republic of Armenia), data-residency posture, sub-processor list, GDPR posture for the Fortress geo-block.
- [Data Processing Agreement](https://nullrun.io/dpa): GDPR Art. 28 form, sub-processor table, audit rights. States plainly that NullRun holds no SOC 2 Type II report and no ISO 27001 certification.
- [Cookies](https://nullrun.io/cookies): minimal cookie inventory — auth + theme only.

## Machine-readable surfaces

- [llms.txt](https://nullrun.io/llms.txt): this file — the curated index.
- [llms-full.txt](https://nullrun.io/llms-full.txt): expanded content manifest (every public page, full-fidelity, retrieval-augmented).
- [llm-info](https://nullrun.io/llm-info): the same facts, section-numbered, as HTML.
- [Docs site llms.txt](https://docs.nullrun.io/llms.txt) and [docs site llms-full.txt](https://docs.nullrun.io/llms-full.txt): the engineering-documentation equivalents.

## Optional

- [Contact](https://nullrun.io/contact): sales, support, and security contact channels.
- [Support](https://nullrun.io/support): the channels that reach a human, plus self-serve resources.
- [GitHub organisation](https://github.com/nullrunio): source code, examples, SDK, and documentation source.