> ## Documentation Index
> Fetch the complete documentation index at: https://vijil-mintlify-a91c9b66.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Runtime

> Agent-level runtime security: identity, tool-permission enforcement, signed manifests, and attestation.

<Tip>
  **TL;DR:** Content [Guardrails](/concepts/defense/guardrail) scan what an [Agent](/owner-guide/register-agents/what-is-an-agent) reads and writes. The Trust Runtime secures what an Agent *is* and *does*: it attests the Agent's identity, fetches its permitted tools and Guard configuration, checks every tool call against a permission policy before execution, and emits an audit trail. One call, `secure_agent()`, wraps a supported framework with the whole stack.
</Tip>

Dome protects Agents two ways. The first is content Guardrails, which intercept inputs and outputs and block flagged content. The second is the Trust Runtime, which governs the Agent as an actor: proving who it is, constraining which tools it may call, and recording what it did.

## Two Ways to Use Dome

<CardGroup cols={2}>
  <Card title="Content Guards" icon="shield">
    Protects the content flowing through the Agent.

    **Core question:** Is this input or output safe?

    **Entry point:** `Dome().guard_input(...)`

    **Blocks:** prompt injection, jailbreaks, toxicity, PII
  </Card>

  <Card title="Trust Runtime" icon="fingerprint">
    Protects the Agent as an actor, its identity and its actions.

    **Core question:** Is this Agent allowed to do this?

    **Entry point:** `secure_agent(...)` or `TrustRuntime(...)`

    **Blocks:** unauthorized tool calls, unattested identities
  </Card>
</CardGroup>

The two compose. The Trust Runtime runs content Guards on every model call *and* enforces tool permissions, so a single `secure_agent()` call gives you both.

## The Trust Stack

`secure_agent()` detects your framework and applies these layers in order:

| Layer               | What It Does                                                                                          |
| ------------------- | ----------------------------------------------------------------------------------------------------- |
| **Identity**        | Attests the Agent's identity via a Vijil API key or SPIFFE workload identity (mTLS).                  |
| **Constraints**     | Fetches tool permissions and Guard configuration from the Vijil Console, or from local configuration. |
| **Content Guards**  | Runs Dome input and output [Guards](/concepts/defense/guard) on every model call.                     |
| **MAC Enforcement** | Checks each tool call against the Agent's permission policy before the tool executes.                 |
| **Audit**           | Emits structured events for every Guard pass, permission decision, and attestation check.             |

## Identity

The Trust Runtime resolves an Agent's identity in priority order:

1. **API key**: extracted from a Vijil client object, when one is provided.
2. **SPIFFE workload identity**: obtained from the local SPIRE agent socket over mTLS.
3. **Unattested**: the Agent ID only, with no cryptographic identity.

When SPIFFE is available, the Trust Runtime can verify *tool* identity too: it connects to each tool endpoint and checks the server certificate's SPIFFE ID against a signed manifest.

## Tool Permissions and Mandatory Access Control

Every Agent has a set of tool permissions: which tools it may call, and which are denied. Before a tool runs, the Trust Runtime checks the call against this policy. Denied calls are blocked in `enforce` mode and logged in `warn` mode. Organization-level rules can deny tools globally, overriding an individual Agent's permissions.

## Signed Manifests and Attestation

A tool manifest lists every tool an Agent is authorized to call, along with each tool's expected SPIFFE identity. Manifests are signed through the Vijil Console and verified locally, so a tampered manifest fails verification. Attestation is the runtime check that confirms every connected tool's certificate matches its manifest entry before the Agent trusts it.

## Enforcement Modes

| Mode      | Behavior                                               | Use It During           |
| --------- | ------------------------------------------------------ | ----------------------- |
| `warn`    | Logs policy violations but allows execution.           | Development and rollout |
| `enforce` | Blocks denied tool calls and replaces flagged content. | Production              |

<Note>
  The Trust Runtime is framework-agnostic at its core. `secure_agent()` supports LangGraph, Google ADK, and Strands directly; for any other framework you use `TrustRuntime` directly, which operates on plain strings and tool names with no framework dependency.
</Note>

## Next Steps

<CardGroup cols={2}>
  <Card title="Framework Integrations" icon="plug" href="/developer-guide/protect/integrations/adk">
    Wrap your agent framework with the Trust Runtime
  </Card>

  <Card title="Guardrail" icon="train-track" href="/concepts/defense/guardrail">
    The content-protection pipeline
  </Card>

  <Card title="Installation" icon="download" href="/developer-guide/protect/installation">
    Install the `trust` and `trust-adapters` extras
  </Card>

  <Card title="Observe" icon="chart-line" href="/concepts/defense/observe">
    Audit events and telemetry
  </Card>
</CardGroup>