Built so your auditors, not just your engineers, sign off.

Secrets, API keys, JWTs, emails, card numbers (Luhn-checked), and SSNs are scrubbed inside your own application process — before a trace is sent anywhere. Even your backend never sees them. Two tiers (standard/strict), custom patterns, key allow/deny lists.

Deterministic rules run as an in-process pre-hook: a violating action (an unescalated $250 refund, say) is blocked BEFORE it executes, with no network in the critical path. Every block is recorded as a hash-chained, re-runnable event — proof the control fired — and rules can be simulated against history before you turn them on. This is application-layer control: it runs inside your process, so prompt injection that takes the process can bypass it, and infrastructure isolation is a separate defence. An agent not calling through Runback at all is a different concern, covered below under Gateway credential isolation, SDK bypass detection and Governance coverage.

By default the gateway (@runback/gateway — base-URL swap, no SDK) forwards whatever credential the agent sends, so the key that reaches the gateway also reaches the provider directly, with nothing to tell you. RUNBACK_GATEWAY_UPSTREAM_KEY and RUNBACK_GATEWAY_TOKEN close that: the real credential lives only in the gateway process, injected server-side, while agents authenticate with a token worthless against the provider. Pair it with an egress rule allowing provider traffic only from the gateway. Unset by default, so it won't break local dev silently.

The SDK integration (withDebugger) has no separate credential to isolate — it never held one apart from your real provider key — so a call outside the wrapper can't be made to fail. It can be noticed, though: installBypassGuard() (or enforceCapture: true) watches for calls to a known model-provider host made outside an instrumented call and reports them as a governance finding, through the same ServiceNow/Jira/PagerDuty pipeline as a coverage gap. "observe" (default) reports and lets the call through, matching the gate's fail-open default; "block" throws. Opt-in, because it patches globalThis.fetch process-wide.

Every run exports as a SHA-256 hash chain with a final content digest, signed by Ed25519 by default — asymmetric, verifiable offline against our published key, no shared secret or account required. Change one byte and verification fails. The digest covers the run's replay oracle too, so the record is re-executable, not just readable. Without a keypair configured, deployments fall back to HMAC-SHA256: integrity, but not non-repudiation, since the verifier holds the same key.

Org-wide, hash-chained log of every run's digest, with signed checkpoints carrying a Merkle root for inclusion proofs — an auditor can verify any run belongs to the sealed history.

Our signature proves nobody else altered the chain — not that we didn't, since we hold the key. So every checkpoint is also time-stamped by two independent RFC 3161 authorities, on certificates we don't control and can't backdate: rewriting history changes the checkpoint head, and no authority will date a token for the new head earlier. The raw tokens verify with `openssl ts -verify` against the authority's own CA, so checking our tamper-evidence needs no Runback software. Time-stamping alone wouldn't catch us keeping two divergent but honestly-timestamped histories and showing each to a different party — so every checkpoint is also published to a public, unauthenticated, hash-chained feed (`GET /api/transparency`), where two heads for the same (log, seq) would sit side by side for anyone who archived it, and the database rejects the second write. We skipped a blockchain anchor deliberately: anchoring needs a public network that air-gapped installs correctly refuse to depend on.

Runback is a Next.js app and a Postgres database. Run it in your own VPC — traces never touch our servers, and there's no telemetry call-home in the self-hosted core.

Enterprise SSO via OpenID Connect (Authorization Code flow), with issuer, audience and nonce verification against the IdP's JWKS. Works with Okta, Microsoft Entra ID, Google Workspace, Auth0 and Ping. Routed per-org by email domain.

Four roles — owner, admin, member, viewer — enforced on every privileged route. Ownership is protected: only an owner can grant owner, and the last owner can't be removed or demoted.

API keys and session/magic-link tokens are never stored in the clear — only a non-secret prefix plus a SHA-256 hash. Session cookies are httpOnly, Secure and SameSite=lax with a bounded lifetime.

Recorded today: API key issuance/revocation, member invites/removals/role changes, model-provider credential changes, policy changes, prompt version saves and label moves, a human overriding a pairwise verdict or correcting a judge's calibration, legal holds placed/released, ledger checkpoint seals, evidence-package exports, and org settings changes. Each is written to a hash-chained log using the same primitive as the run ledger — deleting an entry breaks the chain, so the log can't be edited by the people it audits. Actor, source IP, and target are recorded; secrets never are. Not yet covered: SSO configuration and retention-window changes.

Okta, Entra ID or any SCIM 2.0 provider provisions and deprovisions members automatically — including the discovery endpoints an IdP probes at setup, PATCH/PUT profile pushes, and userName lookup resolved in the database whatever the directory size. Deprovisioning removes access immediately rather than flagging a row inactive, so there's no offboarding step to forget. The endpoint authenticates with a scoped token that can't ingest runs, read run content or open a session, and refuses to deprovision the last owner. Groups aren't implemented; ResourceTypes says so rather than letting an IdP find out mid-sync.

Retention deletion can be suspended for runs under a preservation obligation — litigation, a regulator request, an investigation — org-wide or per agent. Every deletion path consults holds first, and if the holds table can't be read the sweep is skipped: the failure favours keeping data. Placing and releasing a hold are both logged.

Administrative audit events forward to Splunk, Microsoft Sentinel, or any HTTPS collector hourly, so access evidence lands in your SOC, not just our dashboard. Delivery is at-least-once from a per-sink watermark, and every event carries its chain hashes so you can verify the feed wasn't altered in transit.

Declare the agents you expect to be governed and Runback reconciles that inventory against what actually reports: declared but never instrumented, reporting then gone silent, or observed while absent from your register. Findings open a deduplicated ticket in ServiceNow, Jira, or PagerDuty.

OIDC client secrets, customer model-provider keys, SIEM tokens, and workflow credentials are each AES-256-GCM encrypted under their own key, so rotating one never invalidates the others. Plaintext is never stored or returned by an API — only whether a secret is set, and its last four characters where that helps.

Every workspace is an isolated org. Run data carries a composite (org_id, run_id) identity enforced by the database, so a cross-tenant reference is rejected by Postgres, not a check someone might forget. Queries are org-scoped, and a source-level test fails any that aren't. Self-hosting gives each customer a dedicated database outright.

A root-cause explanation or a control's evidence summary can be AI-generated on demand, then sealed the way a run is: hash-chained to your org's prior narratives and signed, with the source evidence pinned by digest. If that evidence later changes, re-verification catches it. The explanation is disposable; the proof it wasn't rewritten is not.

A write-only, narrowly-scoped key lets a guardrail vendor (Lakera, Cisco AI Defense or similar) post findings into your own sealed record rather than siloing them in their dashboard. Each is hash-chained and signed on arrival, independently of your oracle chain, so a vendor's webhook can never alter a run's replay identity.

Issue a read-only, time-limited key scoped to specific runs — or all of them — from Settings, and hand an auditor that instead of a login. It downloads the same signed record your team sees: byte-identical, not a summary. Revocable any time, and every grant is checked for expiry and revocation on every read.