Boundrix Documentation — Technical Specs & Integration Guides

1. Installation Options

Choose the installation method suited for your environment:

Option A: Python SDK

# Install the core Boundrix SDK
pip install boundrix

# Or install directly from SASLABS GitHub repository
pip install git+https://github.com/saslabs/boundrix.git

Option B: Node.js / TypeScript SDK

npm install @boundrix/sdk
# or yarn / pnpm
pnpm add @boundrix/sdk

Option C: Docker Runtime Sidecar (Recommended for Kubernetes)

docker pull boundrix/sidecar:latest

# Run the local evaluation sidecar on port 8080
docker run -d -p 8080:8080 \
  -e BOUNDRIX_ENV=production \
  -e BOUNDRIX_POLICY_FILE=./policy.rego \
  -v $(pwd)/audit.db:/data/audit.db \
  boundrix/sidecar:latest

2. Initializing the Client & First Authorization Call

Connect your agent to the Boundrix decision engine in 3 lines of code:

from boundrix.client import BoundrixClient

# Initialize client pointing to local sidecar or centralized VPC cluster
client = BoundrixClient(base_url="http://localhost:8080", timeout=2.0)

# Evaluate execution boundary before executing a tool call
decision = client.authorize(
    agent_id="agent-coding-01",
    task_id="task-fix-auth-1029",
    action="repo.read",
    resource={"repo": "org/auth-service", "branch": "fix/token-expiry"}
)

if decision.is_allowed:
    print(f"Action ALLOWED! Decision ID: {decision.audit_id}")
else:
    print(f"Action DENIED: {decision.reason}")

3. Fail-Closed Execution Contract

Boundrix enforces a strict **fail-closed** contract:

• If the decision engine is unreachable due to network partition or DNS failure, the SDK raises `BoundrixConnectionError`.

• Agent frameworks **must treat any connection exception as an immediate DENY** and halt consequential tool execution.

1. LangChain & LangGraph Integration

Wrap your LangChain tools with the Boundrix gateway interceptor:

from langchain_core.tools import tool
from boundrix.client import BoundrixClient, AuthorizationDeniedError
from boundrix.gateway import GitHubGateway

# Initialize client & resource gateway
client = BoundrixClient(base_url="http://localhost:8080")
gateway = GitHubGateway(client, agent_id="agent-langchain-01", task_id="task-101")

@tool
def read_repository(repo: str, branch: str) -> str:
    """Reads repository contents on a specific branch."""
    try:
        res = gateway.read_repository(repo, branch)
        return f"Successfully read repo: {res['message']}"
    except AuthorizationDeniedError as e:
        return f"SECURITY BLOCKED: {e.reason}"

@tool
def modify_file(repo: str, branch: str, file_path: str, content: str) -> str:
    """Modifies or creates a file in the repository."""
    try:
        res = gateway.modify_file(repo, branch, file_path, content)
        return f"Successfully modified file: {res['message']}"
    except AuthorizationDeniedError as e:
        return f"SECURITY BLOCKED: {e.reason}"

tools = [read_repository, modify_file]

2. OpenAI & Claude Function Calling

When dispatching native LLM tool calls:

import json
from openai import OpenAI
from boundrix.client import BoundrixClient, AuthorizationDeniedError

openai_client = OpenAI()
boundrix = BoundrixClient(base_url="http://localhost:8080")

def execute_agent_tool_call(tool_call, agent_id="agent-01", task_id="task-101"):
    function_name = tool_call.function.name
    function_args = json.loads(tool_call.function.arguments)

    try:
        # Pre-execution boundary check (< 1ms)
        decision = boundrix.authorize(
            agent_id=agent_id,
            task_id=task_id,
            action=function_name,
            resource=function_args
        )
        if decision.is_allowed:
            return run_real_tool(function_name, function_args)
    except AuthorizationDeniedError as e:
        return json.dumps({
            "error": "AUTHORIZATION_DENIED",
            "reason": e.reason,
            "audit_id": e.audit_id
        })

3. CrewAI Custom Tool Integration

In CrewAI, inherit from `BaseTool`:

from crewai.tools import BaseTool
from boundrix.client import BoundrixClient, AuthorizationDeniedError
from boundrix.gateway import GitHubGateway

class GuardedModifyFileTool(BaseTool):
    name: str = "Guarded Modify File"
    description: str = "Modifies a file in GitHub after verifying Boundrix authorization."
    gateway: GitHubGateway

    def _run(self, repo: str, branch: str, file_path: str, content: str) -> str:
        try:
            res = self.gateway.modify_file(repo, branch, file_path, content)
            return res["message"]
        except AuthorizationDeniedError as e:
            return f"Action DENIED by Boundrix: {e.reason}"

1. Architectural Philosophy

Traditional Identity and Access Management (IAM) systems operate on a static credential model:

User / Service ➔ Static API Key / OAuth Token ➔ Broad Access to System

In autonomous and multi-agent workflows, this paradigm fails. When AI agents act autonomously across multi-step chains:

1. **Authorization is lost downstream**: Downstream microservices only know who called them immediately (e.g., "Service A called Service B"), losing track of the initiating human, the acting agent, and the delegated purpose.

2. **Authority expands unchecked (Scope Creep)**: An agent authorized for Step 1 inadvertently triggers downstream automations for Steps 2, 3, and 4 under broad standing privileges.

3. **Revocation is disconnected**: Revoking an agent's entry credential does not cancel tasks already passed to downstream workers.

**Boundrix introduces Continuous Action Admissibility**:

*"Authority is not granted upfront as a static token; it is continuously evaluated at every execution boundary immediately before a consequential action occurs."*

2. Enforcement Boundaries: What Prevents the Agent from Bypassing Boundrix?

A primary question security buyers and enterprise CISOs ask is:

*"What prevents an autonomous agent from bypassing Boundrix and calling GitHub or downstream APIs directly?"*

Boundrix explicitly defines three deployment modes and enforcement boundaries:

Mode 1: SDK-Only Mode (Application-Level Intercept)

• **Mechanism**: The agent codebase or framework wrapper calls `client.authorize()` immediately before invoking any consequential tool.

• **Enforcement Boundary**: Application layer.

• **Customer Responsibility**: The customer remains responsible for ensuring that the agent process cannot bypass the SDK wrapper (e.g. via direct HTTP requests) within its runtime environment.

Mode 2: Sidecar / Tool-Gateway Mode (Network Isolation Proxy)

• **Mechanism**: The agent environment is sandboxed on the network layer and cannot directly reach external APIs (like GitHub or cloud endpoints). All outbound tool calls must pass through the local Boundrix sidecar or gateway proxy.

• **Enforcement Boundary**: Network boundary.

• **Guarantee**: The sidecar evaluates policies locally and forwards only verified `ALLOW` decisions to downstream targets. Unapproved calls are physically prevented from leaving the host network namespace.

Mode 3: Credential-Broker Mode (Zero Downstream Secrets)

• **Mechanism**: The agent execution environment is never provisioned with long-lived downstream credentials (such as GitHub PATs, database credentials, or AWS keys).

• **Enforcement Boundary**: Cryptographic credential boundary.

• **Guarantee**: Boundrix or the customer-side gateway mints, injects, or signs narrowly scoped, short-lived tokens only after authorization succeeds. Direct unbrokered API calls by an agent are rejected by downstream services due to lack of valid credentials.

**Architecture Note**: We never claim "bypass is impossible" in SDK-only mode. Hard anti-bypass guarantees require either Network Isolation (Sidecar/Gateway) or Cryptographic Isolation (Credential Broker).

3. Multi-Hop Trust Chain Lineage

Every action request carries verifiable origin intent across the entire delegation chain:

┌─────────────────┐       ┌─────────────────┐       ┌─────────────────┐       ┌─────────────────┐
│ Initiating User │ ───►  │ AI Agent (NHI)  │ ───►  │  Task & Scope   │ ───►  │ Execution Target│
│  (Principal)    │       │   (Actor ID)    │       │    (Intent)     │       │ (GitHub / API)  │
└─────────────────┘       └─────────────────┘       └─────────────────┘       └─────────────────┘
         │                         │                         │                         │
         └─────────────────────────┼─────────────────────────┴─────────────────────────┘
                                   ▼
                   ┌───────────────────────────────┐
                   │    Boundrix Decision Point    │
                   │      (POST /authorize)        │
                   └───────────────┬───────────────┘
                                   │
                     ALLOW / DENY / REQUIRE_APPROVAL
                                   │
                                   ▼
                   ┌───────────────────────────────┐
                   │   Immutable Audit Evidence    │
                   └───────────────────────────────┘

Context Transferred Across the Chain:

• **Origin Identity**: Initiating human principal (`user-swati-dev`) for downstream human accountability.

• **Agent Identity**: Acting Non-Human Identity (`agent_id`, `tenant_id`) with strict lifecycle states (`ACTIVE` / `REVOKED`).

• **Delegated Scope**: Scoped `Task` (`repo`, `branch`, `allowed_actions`) preventing scope expansion.

• **Runtime Context**: IP, timestamp, resource attributes, and caller intent preventing stale replay attacks.

4. Latency Budget (< 1ms Decision Overhead)

In an autonomous agent execution step, **>99.8% of time is spent on LLM reasoning and downstream API operations**:

**Net Performance Impact**: Adding ~1ms of authorization check to a 3,500ms agent execution turn represents a **0.03% overhead**, which is completely imperceptible.

1. Core Security Invariants

Boundrix enforces five foundational security invariants across all agentic workflows:

1. **Zero Standing Privilege**: Agents hold zero permanent, unrestricted enterprise tokens or admin privileges.

2. **Task-Bound Delegation**: Authority is granted solely through short-lived, immutable scope receipts.

3. **Per-Call Admissibility**: Authorizations are never cached across distinct execution boundaries.

4. **Fail-Closed Design**: Any error, expiration, network partition, or revocation strictly defaults to `DENY`.

5. **Immutable Evidence**: Every decision generates an auditable, non-repudiable `AuditRecord`.

2. Threat Mitigation Matrix

3. Sequential Policy Pipeline

The policy engine executes sequential, fail-closed checks in strict order:

1. agent.status == AgentStatus.ACTIVE           (Else DENY: "Agent is revoked")
2. task.agent_id == agent.agent_id               (Else DENY: "Task does not belong to this agent")
3. task.status == TaskStatus.ACTIVE             (Else DENY: "Task is not active")
4. now() <= task.expires_at                      (Else DENY: "Task has expired")
5. action in task.allowed_actions               (Else DENY: "Action not permitted for this task")
6. resource matches task.scope                   (Else DENY: "Resource outside task scope")
7. ALL CHECKS PASS ➔ ALLOW                      ("Action within task scope and not expired")

4. Anti-Bypass Guarantees & Enforcement Boundaries

How Boundrix prevents agents from bypassing authorization to reach targets directly:

• **SDK-Only Mode**: Agent calls `authorize()` before tool execution. The customer is responsible for ensuring the runtime cannot execute unbrokered network requests.

• **Sidecar / Tool-Gateway Mode**: The agent is network-isolated and cannot reach target APIs directly. All outbound traffic routes through the Boundrix sidecar, which forwards only `ALLOW` actions.

• **Credential-Broker Mode**: The agent never receives downstream API credentials (e.g. GitHub PATs). Narrowly scoped credentials are only minted or injected post-authorization by the gateway.

**Design Principle**: Bypass prevention is guaranteed at the network and cryptographic credential boundaries, not purely through client-side code conventions.

The Non-Human Identity Explosion

Non-Human Identities (AI agents, service accounts, automated pipelines) now outnumber human employees **45 to 1**.

Enterprises give AI coding agents broad API tokens (`admin`, `read/write`). Once granted, the AI agent has total freedom to take thousands of autonomous actions without human supervision.

**Boundrix Solves This**:

• **Zero Standing Privilege**: AI agents hold zero permanent credentials.

• **Just-In-Time Task Delegations**: Tasks are single-purpose, mathematically scoped, and auto-expire in 15–60 minutes.

• **Continuous Runtime Boundary Checks**: Evaluated immediately before *every single* tool call in **< 1ms**.

• **Instant Kill Switch**: Revoking a task instantly paralyzes the agent from executing further tool calls in real time.

• **Immutable Flight Recorder**: Cryptographically stamps every action with a SHA-256 audit digest.

Competitive Differentiation