Runwall
A Runtime security layer that lets AI agents execute safely
17 followers
A Runtime security layer that lets AI agents execute safely
17 followers
Enterprise-grade execution governance for AI agents. Policy enforcement, risk scoring, taint tracking, approval workflows, and audit trails — all in one platform.
the taint tracking piece is the part I'd want to stress test. if an agent reads a poisoned page, then summarizes or paraphrases it in its own words before using that summary to justify a tool call, does the taint survive the rewrite? most provenance-based taint systems track the literal data flow, and an LLM paraphrasing untrusted content into "new" text is effectively laundering it out of that lineage. curious whether Runwall's risk scoring looks at semantic intent independent of literal string provenance, or if a good enough paraphrase can slip past it.
Hey @galdayan , this is an incredibly sharp question and hits on the exact limitation of traditional, string-based taint tracking (like standard taint propagation in static analysis).
You're 100% correct: LLM paraphrasing effectively acts as a data-laundering step that breaks literal string lineage.
To solve this, Runwall uses a hybrid approach:
Session-Level Taint Flags: Once a 'source' tool (like fetching a web page) runs, the entire execution session is flagged as containing untrusted input. The taint is attached to the state, not the string.
Semantic Intent & Risk Scoring: If the session is flagged, the Policy Engine strictly enforces boundaries on 'sink' tools (like database modifications). It parses the semantic intent of the action itself. Even if the LLM completely rewrites the poisoned instructions into clean prose, the system recognizes the action's intent and checks it against the active session state, triggering human-in-the-loop approval or blocking it entirely.
We essentially treat the LLM as a black box that we assume could be compromised the moment it ingests untrusted data, and we guard the runtime boundaries accordingly!
@dushyantzz the "taint attached to state not the string" framing answers my exact worry - I was assuming you were doing literal lineage tracking that a rewrite could dodge, but if the whole session gets flagged once untrusted input enters, the paraphrase doesn't matter because you're not trying to track the string anymore. that's a meaningfully different approach than most taint-tracking tools I've seen.
@galdayan Exactly! Since we can't treat LLMs like predictable compilers, session level containment is really the only way to sleep easy at night.
Really appreciate the validation Gal, feedback from folks looking at it this closely means a lot!
Congrats on the launch. I run AI agents that execute real actions in my product and the runtime boundary is what keeps me honest, static permission lists never survive contact with real usage. What does Runwall do when a call lands in the gray zone, block it, ask a human, or log and allow?
Thanks @henry_s_jung Totally agree, static permissions fall apart instantly with dynamic agent behaviors.
For the gray zone, you get to decide exactly what happens because Runwall uses OPA/Rego (Policy-as-Code) and semantic risk scoring. You can configure it to do all three:
Ask a human (Default for Gray Zone): Suspend the execution and ping your Slack/dashboard for a quick thumbs up/down.
Log and Allow (Simulation Mode): Run the policy as a "dry run" to monitor how it behaves against live traffic without breaking the agent's flow.
Block: Standard denial if the risk score climbs too high.
You have full control depending on your security tolerance!
(Quick heads up: I am currently migrating the backend infrastructure from Render to AWS for better stability today, so the app/demo might be temporarily unresponsive for a bit!)
Tried the taint tracking on a couple of agent workflows and it actually caught a prompt injection I had missed. Approval workflows feel solid for a real team setup.
Thanks a lot for testing Runwall, @azadfndk143609 That's exactly the kind of real world scenario I built taint tracking for. It's great to hear it helped surface a prompt injection that could have been missed. We'll continue improving our detection capabilities and approval workflows to make AI agents even safer. Thanks again for sharing your experience!
The taint tracking is genuinely useful - finally a clear view of which data an agent touched end to end. Setup took longer than expected, but once policies clicked in, approvals felt smooth and the audit trail was actually readable.
Thanks so much for trying Runwall, @nurullahbekik Really appreciate the detailed feedback. Glad the taint tracking and approval workflow delivered value for you. We also appreciate the note about the setup experience making onboarding much faster is one of our top priorities, and we're already working on simplifying it. If you have any suggestions on where the setup felt confusing, we'd love to hear them!