Skip to main content
TL;DR: Content Guardrails scan what an Agent reads and writes. The Trust Runtime secures what an Agent is and does: it attests the Agent’s identity, fetches its permitted tools and Guard configuration, checks every tool call against a permission policy before execution, and emits an audit trail. One call, secure_agent(), wraps a supported framework with the whole stack.
Dome protects Agents two ways. The first is content Guardrails, which intercept inputs and outputs and block flagged content. The second is the Trust Runtime, which governs the Agent as an actor: proving who it is, constraining which tools it may call, and recording what it did.

​
Two Ways to Use Dome

Content Guards

Protects the content flowing through the Agent.Core question: Is this input or output safe?Entry point: Dome().guard_input(...)Blocks: prompt injection, jailbreaks, toxicity, PII

Trust Runtime

Protects the Agent as an actor, its identity and its actions.Core question: Is this Agent allowed to do this?Entry point: secure_agent(...) or TrustRuntime(...)Blocks: unauthorized tool calls, unattested identities
The two compose. The Trust Runtime runs content Guards on every model call and enforces tool permissions, so a single secure_agent() call gives you both.

​
The Trust Stack

secure_agent() detects your framework and applies these layers in order:

​
Identity

The Trust Runtime resolves an Agent’s identity in priority order:
  1. API key: extracted from a Vijil client object, when one is provided.
  2. SPIFFE workload identity: obtained from the local SPIRE agent socket over mTLS.
  3. Unattested: the Agent ID only, with no cryptographic identity.
When SPIFFE is available, the Trust Runtime can verify tool identity too: it connects to each tool endpoint and checks the server certificate’s SPIFFE ID against a signed manifest.

​
Tool Permissions and Mandatory Access Control

Every Agent has a set of tool permissions: which tools it may call, and which are denied. Before a tool runs, the Trust Runtime checks the call against this policy. Denied calls are blocked in enforce mode and logged in warn mode. Organization-level rules can deny tools globally, overriding an individual Agent’s permissions.

​
Signed Manifests and Attestation

A tool manifest lists every tool an Agent is authorized to call, along with each tool’s expected SPIFFE identity. Manifests are signed through the Vijil Console and verified locally, so a tampered manifest fails verification. Attestation is the runtime check that confirms every connected tool’s certificate matches its manifest entry before the Agent trusts it.

​
Enforcement Modes

The Trust Runtime is framework-agnostic at its core. secure_agent() supports LangGraph, Google ADK, and Strands directly; for any other framework you use TrustRuntime directly, which operates on plain strings and tool names with no framework dependency.

​
Next Steps

Framework Integrations

Wrap your agent framework with the Trust Runtime

Guardrail

The content-protection pipeline

Installation

Install the trust and trust-adapters extras

Observe

Audit events and telemetry
Last modified on July 16, 2026