Trust

Runtime governance.
Explicit limits on what we cover.

What we cover

Covered is what we ship today.
Out of scope is what we deliberately don't claim.

Covered

Defensible today — NullRun is the runtime surface for these controls.

Pre-execution runtime authorization
Every tool call is evaluated against active policies before execution: allow, deny, or require approval.
Action-bound human approvals
An approval is bound to the exact action the operator saw. Same amount, same target, same arguments. Change any detail and it is rejected.
Tool-level policy enforcement
Server-side rules decide which tool names the agent may call. If the gate cannot reach its own source of truth, it never lets the action through.
Cost, rate, and scope limits
Per-workflow spend caps, per-key rate limits, workflow-scoped policies. Hard-block on overrun. No overage.
Tamper-evident audit trail
Append-only audit log with a tamper-evident hash chain. Every block and every approval leaves a hash-chained row you can verify yourself. Allowed calls are recorded in the cost trail instead.
Real-time kill / pause
An operator kills or pauses a live workflow from the dashboard. The signal reaches the SDK in roughly 100 ms; the agent unwinds on the next tool call.
Typed approval conditions
Approval rules encode a typed condition, such as "spend above $500" or "tool is `stripe.charge`". The condition is bound to the action the operator saw and re-evaluated on every check.

Out of scope

We don't claim these.

AI model governance
Training data lineage, model registry, bias evaluation and capability testing are out of scope. NullRun does not train, host, or evaluate models.
Lifecycle and conformity assessment
Not a replacement for an ISO 42001 management system, an EU AI Act conformity assessment body, or a GRC platform.
Prompt injection and adversarial input defense
We don't see prompt content. A compromised agent is constrained by tool authorization, but we don't claim to detect injection itself.
Content safety and anti-hallucination
We don't see LLM output. We gate the action the agent attempts, not the text it produces.
Free-form natural-language predicates
Approval rules must be a typed condition (money threshold, tool-call params). We don't decide on arbitrary natural-language text, and we are not building that.
Behavioral drift detection on model output
We don't see model output. Detecting model drift — bias, hallucination, capability regression — requires evaluating the model, not gating the action.
Multi-agent orchestration
No delegated sub-agent execution ships today. Budgets are org-scoped and workflow-scoped — there is no per-agent pool, and a workflow-scoped policy covers every sub-agent inside it.
We don't replace adjacent categories
IAM answers "who is this?". NullRun answers "is this action authorized right now?". Agent frameworks, guardrails, prompt recorders, SIEM, DLP, GRC and observability live elsewhere. We integrate with them.

Framework coverage

Frameworks:
MITRE ATLAS, MITRE ATT&CK, EU AI Act (1689), NIST AI RMF, ISO/IEC 42001.
Rows marked Partial mean we are a supporting control, not the whole program.

Framework coverage: each NullRun control mapped to the framework article or control it addresses.
Framework	Article / Control	Coverage	NULLRUN surface
MITRE ATLAS	AML.TA0015 — Command & Control	Covered	tool_block, kill switch, WebSocket control plane
MITRE ATLAS	AML.T0053 — LLM Plugin / Tool Compromise	Covered	tool_block glob patterns, registered MCP action sources
MITRE ATLAS	AML.T0024 — Exfiltration via ML Artifacts	Partial	audit log + threshold-based spend alerts
MITRE ATT&CK	TA0011 — Command & Control (tactic)	Covered	kill switch + WebSocket control plane
MITRE ATT&CK	T1078 — Valid Accounts	Covered	per-workflow API key scope, two-phase rotation
MITRE ATT&CK	T1020 — Automated Exfiltration	Covered	tool_block, rate limits, audit trail
EU AI Act	Art. 14 — Human Oversight	Covered	approval flow bound to the specific action approved
EU AI Act	Art. 15 — Accuracy, Robustness, Cybersecurity	Partial	tool_block + audit trail (we are a layer, not the full program)
EU AI Act	Art. 72 — Post-market Monitoring	Covered	audit-log retention, spend alerts, alert channels
NIST AI RMF	MANAGE 4.1	Covered	policy templates, per-org and per-workflow scope
NIST AI RMF	MEASURE 2.x	Covered	observability metrics, audit-log verification
NIST AI RMF	GOVERN 3 / MANAGE 2.x	Covered	approval flow, action-bound grants
ISO 42001	A.6.2 — AI Objectives & Planning	Covered	policy-as-code enforcement at runtime
ISO 42001	A.9 (Operational Controls)	Partial	access control via api-key scope (not a full ISMS replacement)

Specific article numbers and technique IDs are mapped to the NULLRUN feature that addresses them.Not all controls in each framework are listed — only those the runtime layer actually touches.

Verify it yourself

The runtime layer is observable.
Every control listed here is reproducible from the open documentation.

The gate

How the gate decides allow, deny, or require approval — and why it never silently lets an action through.

BREAKER

Security controls

The platform-level security practices that protect data and execution paths.

SECURITY

Operational trust

The four commitments your auditor will ask about.

Encryption & residency

At rest: AES-256 (pgcrypto, sensitive columns)
In transit: TLS 1.2 / 1.3
Key management: Operator-managed secret
Data residency: Frankfurt, Germany (DO FRA1)

Sub-processors

Database: Self-hosted Postgres (DO FRA1)
Cache: Self-hosted Redis (DO FRA1)
Object storage: Off-site backup bucket
Transactional email: Brevo (EU)
Log aggregation: Self-hosted Loki (in-cluster)

Retention & deletion

Audit log: Per plan: up to 90 days
Cost events: up to 90 days
Backups: 7 days rolling
Outbox DLQ: 30 days
Auth tokens: 7 days after expiry

Sample evidence pack

Audit export formats: CSV · JSONL
Tamper evidence: SHA-256 hash chain v4 + HMAC-signed exports
Verify endpoint: /audit-log/verify
Compliance pack ZIP: Roadmap — TBD

Sub-processors are listed with the data they receive and the region they store it in. We notify customers at least 30 days before adding or replacing a sub-processor.

Runtime governance. Explicit limits on what we cover.