Governance

Governance sets the rules that every agent on a runner follows. It decides what agents may do without asking, where they may connect, how much they may spend, and who may change any of it. Open it in Settings → Governance.

The server enforces these rules, not the agents, so a tool can't get around them. Each rule applies to every thread, factory stage and loop. When you save, the new policy takes effect for every thread and running sandbox.

Roles

Each server has three access tokens: admin, operator and viewer. The admin token is set when you install the server. The operator and viewer tokens are optional.

The page shows your role at the top. Only admins can click Save policy, approve requests or deny them.

Tool permissions

Each kind of tool gets one answer:

• Allow lets the agent do it without asking.
• Ask sends the request to the Approvals inbox.
• Deny refuses it.

By default, every kind is set to Allow except Delete files, which is set to Ask.

Always deny commands containing blocks any tool call whose title or input contains one of the phrases you list, separated by commas. The defaults are rm -rf /, git push --force, git push -f, | sh, | bash, mkfs and shutdown.

Forbidden permission modes blocks harness modes you name. By default, bypassPermissions can't be selected.

Approvals

The Approvals inbox in the sidebar lists everything that waits for a person. That includes tool calls set to Ask, factory stages that need approval before they start, and spawned agents when a factory requires approval for each one.

Admins can click Approve or Deny. Each decision is recorded with who made it.

Network egress

Sandboxes have no direct internet access. Every connection goes through the server's proxy and is logged on the thread.

With Only allow these domains (and their subdomains) turned on, which is the default, a sandbox can reach only the domains in the list. The defaults include the main model providers, GitHub, npm, PyPI, crates.io and exa.ai. Each entry can be:

• a domain, such as github.com, which allows every port and its subdomains;
• an IP address;
• host:port, such as 46.101.238.169:27017, which allows one port, for example a database.

Turn the checkbox off to allow outbound connections to any address. They are still logged.

Web search lets agents search the web. It is available while the allowlist is on. See Skills and MCP.

When an agent tries to reach a blocked site, the thread shows Blocked by your network policy, with the host names and an Allow button for each. Admins can click it to add the host to the list. The banner also has a Governance link.

Budgets

Cost per thread (USD) and Tokens per thread stop new turns on a thread once the limit is reached. The thread refuses the next turn and reports that its budget is used up. Both are unlimited by default.

Factories have their own limits, set when you create the factory. They cap the number of agents, how many work at once, and the spend for the whole run. See Factories.

Retention and redaction

• Keep logs (days) sets how long a thread's history is kept. Older events are deleted, and Threadrun checks every hour. The default is 30 days. Leave the field empty to keep logs forever.
• Redact API keys, tokens and private keys from logs is on by default. Secrets are replaced before anything is stored.

Audit log

The history of each thread is a hash chain. Every event is linked to the one before it, so a change to an earlier event shows up.

To check a thread, open its Activity panel and click Verify audit. Threadrun recalculates the chain and reports any event that was changed or removed.

Saving changes

An Unsaved changes badge appears when the form differs from the saved policy. Click Save policy to apply your changes. Reset to defaults loads the default values into the form. Click Save policy to apply them.