Your agents built to endure.
Securely run agents you don’t trust.
Agents are easy to demo and hard to trust. Andyur runs them anyway. It works out exactly what one run may do, then enforces that outside the agent. The agent holds no production credential and is offered no tool beyond its grant.
Bring the container you already have. No SDK.
runtime: image: ref: ghcr.io/acme/agent digest: sha256:8b2c…5fbd lifecycle: max_seconds: 7200 model: requested: claude-sonnet access: proxy capabilities: tools: - server: tickets tools: [read_ticket, close_ticket]
image sha256:8b2c…signed command as reviewed lifetime 7200 3600clamped model claude-sonnet api key at the brokerbrokered tools read_ticketgranted close_ticketdropped secrets none in the run
How a run is governed
Decided in one place. Enforced outside the agent.
Every run passes through the same three steps, and enforcement never depends on the agent behaving.
Declare
A manifest says what the agent wants: image, command, model, tools, lifetime. It grants nothing.
Resolve
Policy intersects the request with what the platform allows. The result can only get smaller. It is signed, and pinned to the image digest and command that were reviewed.
Govern
Each run gets its own gateway. It strips whatever the agent set, attaches the approved credential, and routes only to the approved target.
Identity
Named
Every agent and every run gets a cryptographic identity. Short-lived, attested, verifiable at every hop. No shared API keys, and no vendor credential inside the agent.
Governance
Bounded
A manifest is a request, never a grant. What one run may do is computed once, server-side, from the acting user, the agent's ceiling, and the target. It expires with the run.
Observability
Witnessed
One run, one trace. Every decision, tool call, and handoff recorded and attributable to the agent that made it, across every process it touched.
Bring your own agent
Your container. Your framework. Our boundary.
Andyur runs the image you already build, on any agent framework or none. There is no SDK to adopt and nothing to import. The boundary sits outside the container, so the agent does not need to know Andyur exists.
Next: unmodified stock open-source tools, run under the same boundary with no Andyur awareness at all.
- Self-hostedDocker on one host, or Kubernetes for the cluster. Your infrastructure, your data.
- Nothing hiddenEvery hardening control is named, and the platform refuses to start in production without it.
- Nothing forcedIdentity plane, policy engine, credential vault and tracing are each opt-in. The first run needs none of them.
Built on open standards
Composed, not reinvented.
Every seam is documented, so you can swap in your own identity provider, policy engine, or vault, and it never locks you in.