# CTRLRun

> The execution safety layer for AI agents.

- [CTRLRun](https://docs.ctrlrun.dev/index.md): The execution safety layer for AI agents. Every consequential action happens once, exactly as approved, or not at all, and leaves a receipt.
- [Why CTRLRun](https://docs.ctrlrun.dev/why.md): Five principles for AI agents that act on the real world: a failure is not an unknown, an approval binds to what the human saw.
- [Install](https://docs.ctrlrun.dev/get-started/install.md): pip install ctrlrun puts one package, pyyaml and click on your machine, nothing else. Python 3.11 or later.
- [60-second quickstart](https://docs.ctrlrun.dev/get-started/quickstart.md): Protect one function end to end: write a policy, decorate the call, watch a small refund run, a large one wait for a human.
- [Three ways in](https://docs.ctrlrun.dev/get-started/three-ways-in.md): The @protect decorator covers anything in your Python process, the MCP gateway covers tools behind an MCP server in any language.
- [Choosing between them](https://docs.ctrlrun.dev/get-started/choosing.md): In-process Python: the decorator. Tools behind MCP: the gateway. A framework with its own approval UI: an adapter.
- [CTRLRun and MCP](https://docs.ctrlrun.dev/mcp/overview.md): CTRLRun works with MCP in three ways: the gateway enforces policy, approval binding, effect keys and receipts in front of any MCP server.
- [The gateway in five minutes](https://docs.ctrlrun.dev/mcp/gateway-in-5-minutes.md): You already run an MCP server. Two commands put CTRLRun between the agent and it.
- [Use the docs from your editor](https://docs.ctrlrun.dev/mcp/use-the-docs-from-your-editor.md): This documentation is an MCP server. One configuration block adds it to Cursor, VS Code or any MCP client, so the assistant answers from these pages.
- [Action and hash](https://docs.ctrlrun.dev/concepts/action-and-hash.md): An action is a named operation with canonical arguments, a resource, a principal and an environment.
- [Decisions](https://docs.ctrlrun.dev/concepts/decisions.md): A decision is one of allow, approve or deny, made per action by a policy that matches rules first-wins over the action's arguments and cannot see who is.
- [Approval binding](https://docs.ctrlrun.dev/concepts/approval-binding.md): An approval is bound to the hash of the exact action a human saw, is used once, expires.
- [Effect keys](https://docs.ctrlrun.dev/concepts/effect-keys.md): An effect key names the real-world consequence of an action, such as refund:txn_1, so that a retry.
- [Outcomes and AMBIGUOUS](https://docs.ctrlrun.dev/concepts/outcomes-and-ambiguous.md): An executed action ends COMMITTED, FAILED or AMBIGUOUS. Only NotExecuted, raised by the executor, means FAILED.
- [Receipts and evidence](https://docs.ctrlrun.dev/concepts/receipts-and-evidence.md): A receipt is a portable JSON record of one executed action: who, what, the decision, the approval, the effect key.
- [Authority and delegation](https://docs.ctrlrun.dev/concepts/authority-and-delegation.md): Authority is the second axis: a grant says which principal may propose which action, opt-in and then fail-closed, evaluated before the policy.
- [Observe mode](https://docs.ctrlrun.dev/concepts/observe-mode.md): mode: observe runs every real decision against real traffic and records what enforcement would have blocked, without blocking anything.
- [Fail closed](https://docs.ctrlrun.dev/concepts/fail-closed.md): Fail closed means anything CTRLRun cannot decide is denied: an unknown action, a missing or malformed policy, a missing or expired principal, a missing.
- [Protect a function](https://docs.ctrlrun.dev/guides/protect-a-function.md): Wrap the function that acts with @ctrlrun.protect, name the action and its effect key, say who is acting.
- [Put the gateway in front of MCP](https://docs.ctrlrun.dev/guides/gateway-in-front-of-mcp.md): Two commands put policy, approval binding, effect keys and receipts in front of an existing MCP server, in any language.
- [Approve in Slack](https://docs.ctrlrun.dev/guides/approvals-in-slack.md): Route approval requests to a webhook with WebhookApprovalProvider: one signed POST per request, a human answers in Slack or any chat tool.
- [Resolve an AMBIGUOUS effect](https://docs.ctrlrun.dev/guides/resolve-an-ambiguous-effect.md): Find the effects nobody knows the outcome of with ctrlrun effects, ask the remote what happened, say so with ctrlrun resolve --committed or --failed.
- [Reconcile automatically](https://docs.ctrlrun.dev/guides/reconcile-automatically.md): Give @protect a reconcile hook that asks the remote what happened to an effect key.
- [Roll out observe, then enforce](https://docs.ctrlrun.dev/guides/observe-to-enforce.md): Put mode: observe at the top of the policy, run real traffic for a week, read ctrlrun stats to see what enforcement would have blocked and why.
- [Run on Postgres](https://docs.ctrlrun.dev/guides/run-on-postgres.md): Move the store from SQLite to Postgres when more than one host must share it: pip install ctrlrun[postgres], a connection URL, a schema.
- [Verify in CI](https://docs.ctrlrun.dev/guides/verify-in-ci.md): Run ctrlrun verify against your policy on every push with the CTRLRun GitHub Action, read the two shapes of report, understand the N/A line.
- [Export to OpenTelemetry](https://docs.ctrlrun.dev/guides/export-to-opentelemetry.md): Add OTelEventSink to a Control and every action becomes one span with one span event per step, in whatever tracing backend your process already exports to.
- [Use the LangGraph adapter](https://docs.ctrlrun.dev/guides/langgraph-adapter.md): Route an approve decision through LangGraph's own interrupt() with ctrlrun-langgraph.
- [Use the OpenAI Agents SDK adapter](https://docs.ctrlrun.dev/guides/openai-agents-adapter.md): Route an approve decision through the OpenAI Agents SDK's tool-approval interruption with ctrlrun-openai-agents.
- [Cookbook](https://docs.ctrlrun.dev/cookbook/index.md): One recipe per real situation: the policy, the code with a fake remote, what the agent sees when refused or asked, the receipt.
- [A credential-rotation agent](https://docs.ctrlrun.dev/cookbook/credential-rotation-agent.md): An agent rotates API keys: minting the new key runs on its own, revoking the old one waits for a human, and a lost reply is never repeated blindly.
- [A CRM-update agent](https://docs.ctrlrun.dev/cookbook/crm-update-agent.md): An agent updates customer records from conversations: a field update runs on its own, merging two records waits for a human, deleting a record is refused.
- [A customer-notification agent](https://docs.ctrlrun.dev/cookbook/customer-notification-agent.md): An agent notifies customers about an incident: one effect per customer per incident, so a retry.
- [A data-deletion agent under a retention rule](https://docs.ctrlrun.dev/cookbook/data-deletion-agent.md): An agent handles deletion requests: records past retention are purged on their own, records inside retention wait for a human.
- [A database-migration agent](https://docs.ctrlrun.dev/cookbook/database-migration-agent.md): An agent runs schema migrations: forward migrations on staging run on their own, every production migration waits for a human, a rollback is refused.
- [A deploy agent](https://docs.ctrlrun.dev/cookbook/deploy-agent.md): An agent operates a Kubernetes cluster: a rollout restart runs on its own, applying to production waits for a human.
- [An IAM agent that can grant read but never admin](https://docs.ctrlrun.dev/cookbook/iam-agent.md): An access-request agent grants roles: read and viewer roles run on their own, anything else waits for a human.
- [LangGraph with interrupt()](https://docs.ctrlrun.dev/cookbook/langgraph-interrupt.md): Route a refund's approval through LangGraph's own interrupt(): the operator builds the Control.
- [A manager agent delegating bounded authority to a worker](https://docs.ctrlrun.dev/cookbook/manager-and-worker.md): A manager agent holds a delegable grant, hands a worker a narrower slice for one job, the worker cannot exceed or widen it.
- [Observe for a week, then enforce](https://docs.ctrlrun.dev/cookbook/observe-then-enforce.md): Run the real policy in observe mode against real traffic, execute everything, record what enforcement would have blocked.
- [OpenAI Agents SDK tool approval](https://docs.ctrlrun.dev/cookbook/openai-agents-tool-approval.md): Route a refund's approval through the OpenAI Agents SDK's own tool-approval interruption.
- [An outbound-email agent with external-recipient approval](https://docs.ctrlrun.dev/cookbook/outbound-email-agent.md): An agent sends email: messages inside the company go on their own, any message to an external domain waits for a human who sees the exact recipient.
- [A payout agent with maker/checker via delegation](https://docs.ctrlrun.dev/cookbook/payout-maker-checker.md): A treasury lead holds a delegable grant, delegates a narrower slice to a payout agent.
- [Protect an existing MCP server in five minutes](https://docs.ctrlrun.dev/cookbook/protect-an-mcp-server.md): Put the gateway in front of an MCP server you already run: name its tools in a policy, start ctrlrun gateway.
- [Receipts into OpenTelemetry](https://docs.ctrlrun.dev/cookbook/receipts-to-opentelemetry.md): Attach OTelEventSink to the Control and every action becomes one span with one event per step in your tracing backend.
- [Reconcile against Stripe or Kubernetes automatically](https://docs.ctrlrun.dev/cookbook/reconcile-against-the-remote.md): A reconcile hook per action asks the remote what happened to an effect key, so a lost Stripe reply or a dropped kubectl connection resolves itself.
- [A refund agent with amount tiers](https://docs.ctrlrun.dev/cookbook/refund-agent.md): A support agent refunds customers: small refunds run on their own, larger ones wait for a human, anything above a ceiling is refused.
- [Resolve an ambiguous effect](https://docs.ctrlrun.dev/cookbook/resolve-an-ambiguous-effect.md): An effect nobody knows the outcome of blocks its own retry; a human asks the remote, records the answer with ctrlrun resolve.
- [Approvals in Slack via webhook](https://docs.ctrlrun.dev/cookbook/slack-approvals.md): The approval request goes out as one signed POST, a human answers in Slack, the answer comes back signed to the gateway's endpoint.
- [Move from SQLite to Postgres](https://docs.ctrlrun.dev/cookbook/sqlite-to-postgres.md): One line changes: the store. The code reads CTRLRUN_STORE_URL and builds a PostgresStateStore when it names a database, a SQLiteStateStore otherwise.
- [Run verify in GitHub Actions](https://docs.ctrlrun.dev/cookbook/verify-in-github-actions.md): Run ctrlrun verify against your policy on every push with the CTRLRun action: the workflow, the report it produces, the N/A line, the exit codes.
- [CTRLRun and framework human-in-the-loop](https://docs.ctrlrun.dev/compare/framework-hitl.md): A framework interrupt is where a human says yes. It does not bind that yes to the arguments that execute, or refuse a retry after a lost reply. Use both.
- [CTRLRun and guardrail libraries](https://docs.ctrlrun.dev/compare/guardrail-libraries.md): Guardrail libraries inspect what goes into and comes out of a model. CTRLRun sits at the boundary between deciding to act and having acted.
- [CTRLRun and agent oversight toolkits](https://docs.ctrlrun.dev/compare/governance-toolkits.md): Oversight toolkits catalogue agents, monitor their behaviour and report on it. CTRLRun refuses, in the execution path, per action, and emits the evidence.
- [CTRLRun and durable workflow engines](https://docs.ctrlrun.dev/compare/durable-workflows.md): A workflow engine makes a workflow finish, retrying until it succeeds. CTRLRun decides whether an effect may happen at all, and never retries an unknown.
- [CTRLRun and idempotency keys](https://docs.ctrlrun.dev/compare/idempotency-keys.md): An idempotency key deduplicates at one API that chose to support it. An effect key deduplicates at the agent, across every API it touches.
- [Frequently asked questions](https://docs.ctrlrun.dev/faq.md): Twelve questions engineers ask about CTRLRun: idempotency keys, workflow engines, adapters, guarantees, timeouts, receipts, and what is not covered.
- [Policy YAML reference](https://docs.ctrlrun.dev/reference/policy-yaml.md): Every key of ctrlrun.yaml, from ctrlrun.policy/v1 to v4: schema, actions, decision, rules, when conditions and their seven operators.
- [Authority YAML reference](https://docs.ctrlrun.dev/reference/authority-yaml.md): Every key of the authority: section: max_delegation_depth and grants, and on a grant id, subject (agent, user), actions, resources, constraints.
- [CLI reference](https://docs.ctrlrun.dev/reference/cli.md): Every ctrlrun command and option, from the command's own help text: init, demo, approve, deny, receipts, effects, resolve, inspect, stats, verify.
- [Receipt and event schemas](https://docs.ctrlrun.dev/reference/receipt-and-event-schemas.md): Every field of a CTRLRun receipt and of an event, and every event type, rendered from the dataclasses that write them.
- [Exit codes](https://docs.ctrlrun.dev/reference/exit-codes.md): What each ctrlrun command's exit status means: 0 done, 1 a refusal or a failed guarantee, 2 a usage error or an unusable configuration.
- [Errors](https://docs.ctrlrun.dev/reference/errors.md): The closed set of CTRLRun exceptions, each with its base class and when it is raised: ActionDenied, ApprovalRequired, DuplicateEffect and the rest.
- [Python API](https://docs.ctrlrun.dev/reference/api/index.md): Every frozen public name of the ctrlrun package and its extras, one page each, rendered from the docstrings.
- [Action](https://docs.ctrlrun.dev/reference/api/Action.md): A proposed agent action: what, with which arguments, by whom, on what.
- [ActionDenied](https://docs.ctrlrun.dev/reference/api/ActionDenied.md): The action may not run. `reason` says why, e.g. `unknown_action` (SPEC-v0.1 §3.4).
- [AmbiguousEffect](https://docs.ctrlrun.dev/reference/api/AmbiguousEffect.md): The outcome of this effect is unknown; only a human may resolve it (SPEC-v0.1 §5.4).
- [Approval](https://docs.ctrlrun.dev/reference/api/Approval.md): A human's grant, bound to one `action_hash` (SPEC-v0.1 §4.1).
- [ApprovalAnswer](https://docs.ctrlrun.dev/reference/api/ApprovalAnswer.md): A human's answer, and who gave it (SPEC-v0.5 §2.2, §3.4).
- [ApprovalMismatch](https://docs.ctrlrun.dev/reference/api/ApprovalMismatch.md): The presented approval does not authorize this action (SPEC-v0.1 §4.2).
- [ApprovalProvider](https://docs.ctrlrun.dev/reference/api/ApprovalProvider.md): How a human is asked, and how the answer comes back (SPEC-v0.1 §4.3).
- [ApprovalRequest](https://docs.ctrlrun.dev/reference/api/ApprovalRequest.md): A pending question for a human: may this exact action run? (SPEC-v0.1 §4.1)
- [ApprovalRequired](https://docs.ctrlrun.dev/reference/api/ApprovalRequired.md): The action needs a human. `request_id` is what `ctrlrun approve` takes (SPEC §4.3).
- [ApprovalTimeout](https://docs.ctrlrun.dev/reference/api/ApprovalTimeout.md): Nobody answered the approval request in time (SPEC-v0.1 §4.3).
- [Authority](https://docs.ctrlrun.dev/reference/api/Authority.md): The `authority:` section, loaded and evaluable (SPEC-v0.3 §4).
- [AuthorityDenied](https://docs.ctrlrun.dev/reference/api/AuthorityDenied.md): The principal holds no grant that covers this action (SPEC-v0.3 §4.3).
- [AuthorityEscalation](https://docs.ctrlrun.dev/reference/api/AuthorityEscalation.md): A delegation that may not exist: it is not contained in its parent (SPEC-v0.3 §5.3).
- [AuthorityResult](https://docs.ctrlrun.dev/reference/api/AuthorityResult.md): What the authority axis decided, and which grant it decided on (§4.8).
- [CTRLRunError](https://docs.ctrlrun.dev/reference/api/CTRLRunError.md): Base class for every error raised by CTRLRun.
- [Condition](https://docs.ctrlrun.dev/reference/api/Condition.md): One `<argument>_<op>: operand` test against an action's arguments (SPEC-v0.1 §3.2).
- [Control](https://docs.ctrlrun.dev/reference/api/Control.md): Policy, state and evidence composed around a single action (SPEC-v0.1 §8).
- [Decision](https://docs.ctrlrun.dev/reference/api/Decision.md): What may happen to an action: exactly three outcomes in v0.1 (SPEC-v0.1 §3.3).
- [Delegation](https://docs.ctrlrun.dev/reference/api/Delegation.md): A grant created at runtime by a principal who already holds one (SPEC-v0.3 §5.1).
- [DelegationRecord](https://docs.ctrlrun.dev/reference/api/DelegationRecord.md): One row of the `delegations` table (SPEC-v0.3 §5.2).
- [DuplicateEffect](https://docs.ctrlrun.dev/reference/api/DuplicateEffect.md): This logical effect already happened, or is happening now (SPEC-v0.1 §5.4).
- [EffectKeyError](https://docs.ctrlrun.dev/reference/api/EffectKeyError.md): An effect template cannot be resolved to a key (SPEC-v0.1 §5.1).
- [EffectRecord](https://docs.ctrlrun.dev/reference/api/EffectRecord.md): What a StateStore holds for one effect key (ARCHITECTURE §5).
- [EffectState](https://docs.ctrlrun.dev/reference/api/EffectState.md): Where a logical effect stands (SPEC-v0.1 §5.2).
- [Event](https://docs.ctrlrun.dev/reference/api/Event.md): One ordered step in the life of an action (SPEC-v0.1 §6.2).
- [EventSink](https://docs.ctrlrun.dev/reference/api/EventSink.md): Somewhere a copy of every `Event` and `Receipt` goes (SPEC-v0.2 §4.1).
- [FrameworkInterrupt](https://docs.ctrlrun.dev/reference/api/FrameworkInterrupt.md): One framework's human-in-the-loop primitive, and nothing else (SPEC-v0.5 §2.1).
- [Grant](https://docs.ctrlrun.dev/reference/api/Grant.md): One permission: this subject may propose these actions, under these limits (§4.2).
- [HeaderIdentityProvider](https://docs.ctrlrun.dev/reference/api/HeaderIdentityProvider.md): The principal named by a trusted HTTP header (§3.3).
- [IdentityContext](https://docs.ctrlrun.dev/reference/api/IdentityContext.md): What a provider is told about the call it is resolving a principal for (§3.1).
- [IdentityError](https://docs.ctrlrun.dev/reference/api/IdentityError.md): A credential was offered and rejected (SPEC-v0.3 §3.2).
- [IdentityProvider](https://docs.ctrlrun.dev/reference/api/IdentityProvider.md): Resolves the principal for one action (SPEC-v0.3 §3.1).
- [InMemoryStateStore](https://docs.ctrlrun.dev/reference/api/InMemoryStateStore.md): Everything held in process memory: for tests and `ctrlrun demo`.
- [InterruptApprovalProvider](https://docs.ctrlrun.dev/reference/api/InterruptApprovalProvider.md): An `ApprovalProvider` whose `wait()` routes through a framework's own primitive.
- [InvalidArgument](https://docs.ctrlrun.dev/reference/api/InvalidArgument.md): An argument cannot be accepted as given.
- [JSONLEventSink](https://docs.ctrlrun.dev/reference/api/JSONLEventSink.md): The JSONL half of the evidence: two append-only files in one directory (SPEC §6).
- [LocalApprovalProvider](https://docs.ctrlrun.dev/reference/api/LocalApprovalProvider.md): Requests go to the StateStore; `wait()` polls it (SPEC-v0.1 §4.3).
- [MissingDependency](https://docs.ctrlrun.dev/reference/api/MissingDependency.md): An optional extra is not installed (SPEC-v0.2 §1.1, §11).
- [NotExecuted](https://docs.ctrlrun.dev/reference/api/NotExecuted.md): Raised by an executor to assert the remote side did nothing (SPEC-v0.1 §5.5).
- [PendingApproval](https://docs.ctrlrun.dev/reference/api/PendingApproval.md): What the framework's interrupt is handed, and the only thing it is (SPEC-v0.5 §2.3).
- [Policy](https://docs.ctrlrun.dev/reference/api/Policy.md): Action-level autonomy policy: which actions may run, and under which conditions.
- [PolicyError](https://docs.ctrlrun.dev/reference/api/PolicyError.md): The policy is missing, unreadable, or malformed. Raised at load time (SPEC-v0.1 §3.4).
- [Principal](https://docs.ctrlrun.dev/reference/api/Principal.md): Who is acting: an agent, optionally on behalf of a human.
- [Receipt](https://docs.ctrlrun.dev/reference/api/Receipt.md): Portable evidence of one action that reached a terminal state (SPEC-v0.1 §6.1).
- [ReconcileOutcome](https://docs.ctrlrun.dev/reference/api/ReconcileOutcome.md): What a `reconcile` hook may answer about an effect key (SPEC-v0.2 §2).
- [SQLiteStateStore](https://docs.ctrlrun.dev/reference/api/SQLiteStateStore.md): Approvals, effects and evidence in one SQLite file (ARCHITECTURE §5).
- [SchemaMismatch](https://docs.ctrlrun.dev/reference/api/SchemaMismatch.md): A store met a database it does not recognise, in either direction (SPEC-v0.6 §3.3).
- [ScriptedApprovalProvider](https://docs.ctrlrun.dev/reference/api/ScriptedApprovalProvider.md): A human replaced by a fixed script: for tests and `ctrlrun demo` (SPEC-v0.1 §4.3).
- [StateStore](https://docs.ctrlrun.dev/reference/api/StateStore.md): Durable state behind a `Control` (SPEC-v0.1 §5.3): approvals, effects, evidence.
- [StaticIdentityProvider](https://docs.ctrlrun.dev/reference/api/StaticIdentityProvider.md): A fixed principal, for development, tests and single-tenant demonstrations (§3.3).
- [Subject](https://docs.ctrlrun.dev/reference/api/Subject.md): Who a grant is addressed to: an agent pattern, a user pattern, or both (§4.2).
- [Suspended](https://docs.ctrlrun.dev/reference/api/Suspended.md): Raised by an executor: the remote asked for something before it will finish.
- [WebhookApprovalProvider](https://docs.ctrlrun.dev/reference/api/WebhookApprovalProvider.md): Notify a human system on `APPROVAL_REQUESTED`, and let it answer (SPEC-v0.2 §7).
- [AcsControlHook](https://docs.ctrlrun.dev/reference/api/acs-AcsControlHook.md): Answer ACS `steps/*` hooks with CTRLRun's decisions and outcomes.
- [action_hash](https://docs.ctrlrun.dev/reference/api/action_hash.md): Return the action hash used to bind approvals to an exact action (SPEC-v0.1 §2.3).
- [banner](https://docs.ctrlrun.dev/reference/api/banner.md): Log SPEC-v0.3 §6.5's observe banner, once per `Control`. An adapter MUST call it (§3.6).
- [canonical_bytes](https://docs.ctrlrun.dev/reference/api/canonical_bytes.md): The canonical form of an arbitrary mapping: UTF-8 JSON, sorted keys, no whitespace.
- [canonicalize](https://docs.ctrlrun.dev/reference/api/canonicalize.md): Return the canonical form of an Action: UTF-8 JSON, sorted keys, no whitespace.
- [run](https://docs.ctrlrun.dev/reference/api/conformance-run.md): Drive every suite through `adapter` and report what each came to (SPEC-v0.5 §5).
- [run](https://docs.ctrlrun.dev/reference/api/conformance-store-run.md): Drive every case against `backend` and report what each came to (SPEC-v0.6 §2).
- [context](https://docs.ctrlrun.dev/reference/api/context.md): Bind the principal for calls made inside the block.
- [serve](https://docs.ctrlrun.dev/reference/api/gateway-serve.md): Run a gateway in front of one upstream MCP server (SPEC-v0.2 §6.1).
- [JWTIdentityProvider](https://docs.ctrlrun.dev/reference/api/jwt_identity-JWTIdentityProvider.md): Verify a bearer JWT and map its verified claims onto a `Principal` (SPEC-v0.3 §3.4).
- [needs_approval](https://docs.ctrlrun.dev/reference/api/needs_approval.md): Does this call need a human? For a framework that asks before it invokes (SPEC-v0.5 §3.5).
- [OTelEventSink](https://docs.ctrlrun.dev/reference/api/otel-OTelEventSink.md): Export every `Event` and `Receipt` as OpenTelemetry spans (SPEC-v0.2 §8).
- [parse_conditions](https://docs.ctrlrun.dev/reference/api/parse_conditions.md): Parse a `when:`-shaped mapping into conditions, keyed by the raw condition key.
- [PostgresStateStore](https://docs.ctrlrun.dev/reference/api/postgres-PostgresStateStore.md): Approvals, effects and evidence in a Postgres schema (SPEC-v0.6 §4).
- [protect](https://docs.ctrlrun.dev/reference/api/protect.md): Bind a function to an action name: every call becomes a decided, recorded Action.
- [run](https://docs.ctrlrun.dev/reference/api/verify-run.md): Run the applicable guarantees against this configuration and report (§9.1).
- [with_approval](https://docs.ctrlrun.dev/reference/api/with_approval.md): Present a granted approval to the calls made inside the block (SPEC-v0.1 §4.3).
- [ARCHITECTURE](https://docs.ctrlrun.dev/ARCHITECTURE.md)
- [What verify guarantees](https://docs.ctrlrun.dev/security/verify-guarantees.md): The eleven guarantees ctrlrun verify runs against your own policy and store, what each one exercises, what not applicable means and why it is never a pass.
- [The receipt chain](https://docs.ctrlrun.dev/security/receipt-chain.md): Each receipt carries the hash of the one before it, so an edit, a deletion from the middle or a reordering is detected and named by seq.
- [Reporting a vulnerability](https://docs.ctrlrun.dev/security/disclosure.md): Report privately to contact@arpanghoshal.com or through GitHub's private vulnerability reporting.
- [THREAT MODEL](https://docs.ctrlrun.dev/THREAT_MODEL.md)
- [How this is built](https://docs.ctrlrun.dev/how-this-is-built.md)
- [SPEC v0.1](https://docs.ctrlrun.dev/SPEC-v0.1.md)
- [SPEC v0.2](https://docs.ctrlrun.dev/SPEC-v0.2.md)
- [SPEC v0.3](https://docs.ctrlrun.dev/SPEC-v0.3.md)
- [SPEC v0.4](https://docs.ctrlrun.dev/SPEC-v0.4.md)
- [SPEC v0.5](https://docs.ctrlrun.dev/SPEC-v0.5.md)
- [SPEC v0.6](https://docs.ctrlrun.dev/SPEC-v0.6.md)
- [OWASP AGENTIC TOP10](https://docs.ctrlrun.dev/OWASP-AGENTIC-TOP10.md)
- [ACS](https://docs.ctrlrun.dev/ACS.md)
- [Adapters](https://docs.ctrlrun.dev/adapters.md)
- [Authority](https://docs.ctrlrun.dev/authority.md)
- [Postgres](https://docs.ctrlrun.dev/postgres.md)
- [Verify](https://docs.ctrlrun.dev/verify.md)
- [CLAIMS](https://docs.ctrlrun.dev/CLAIMS.md)
- [ROADMAP](https://docs.ctrlrun.dev/ROADMAP.md)