ray.run: control what every agent can do
Log in

A token is not a person.

Every client token belongs to a person and a workspace. Rayrun records each call against that person, even after the token is revoked.

Roles decide who can manage services and shared credentials. Tool policies decide what each client can run.

Three roles.

  • Owner

    • Manage billing and the plan
    • Do everything an admin can
    • Delete the workspace

  • Admin

    • Add and authorize services
    • Write and deploy hosted hooks
    • Invite people and assign roles
    • Decide who reaches what

  • Member

    • Use authorized services
    • Read the activity log
    • Never see a secret

Decide what happens when a tool is called.

Set one default per service. Change any single tool. A client can choose less access, never more.

  • Allow

    The call goes through. A hook, an argument rule, or content scanning can still hold it.

  • Ask

    A person approves that exact call before it leaves Rayrun.

  • Block

    The tool stays out of reach.

Ask approves one exact call. If the arguments, policy, client, or tool version change, the approval cannot be reused.

In Code Mode, an approved program resumes where it paused. In Direct Mode, a retry must carry Rayrun’s server-issued state and the browser decision.

Not every call to a tool is the same.

A payment of 20 is ordinary. A payment of 20,000 deserves a look. Blocking the tool loses the ordinary calls. Allowing it loses the check.

An argument rule moves the decision to the call. A rule:

  • Names one argument, a condition, and a value, then asks or blocks.
  • Reads back as a sentence: Ask when amount is greater than 100.
  • Applies to every client, in Direct Mode and Code Mode.
  • Only tightens. It cannot open a call your policy refused.
  • Runs on the arguments the service will receive, after any hook.

Test a set of arguments before you rely on a rule. Rayrun shows which rule would fire and whether content scanning would refuse. Nothing is sent upstream. What a rule can say.

Callrefund_chargeamir
{
  "charge": "ch_8f2a",
  "amount": 480
}
Ask rule
DecisionHeld for review

Ask when amount is greater than 100

approved
Recordrefund_charge412msamir · claude-code · 09:41:02Approvedby amir
{ "status": "refunded" }
Callwrite_filedana
{
  "path": "/etc/hosts",
  "content": "…"
}
Block rule
DecisionBlocked

Block when path does not start with /workspace

The client gets an error naming the rule. Nothing reached the service.

nothing ran
Recordwrite_file—dana · codex · 09:40:51Blockedby ruleNo result. Nothing ran.

Decide what the model gets back.

A safe tool can still return far more than the task needs.

  • Pick output fields from the tool’s schema. Rayrun exposes the reduced contract in both modes.
  • Every projected call records the allowlist digest and the before-and-after byte counts.
  • Hooks handle anything that needs code. They can reject a call or add approval. They cannot weaken policy. How hooks work.

Content scanning reads both directions for secrets, personal data, and instructions written to the model.

  • A match in a result is masked before the model sees it.
  • A match in an argument stops the call.
  • Monitor mode shows what would change before anything does.
  • Choose literal markers, RE2 patterns, AWS Comprehend PII, or Bedrock Guardrails. Preview an immutable draft and publish to Monitor before enforcing. Findings identify the detector revision.

AWS detectors require deployment credentials and send text to AWS, including in Monitor and preview. Live AWS behavior is not yet verified. External enforcement redacts whole output fields and suppresses tool payload capture. Detector setup and limits.

Shared credentials need an administrator.

Only an owner or admin can authorize a credential shared by the workspace. Members can authorize their own account for per-person services.

Every activity row names the person and the client.

Offboarding revokes access.

  • Remove someone from Members. Their tokens stop working at once.
  • Their browser leaves the workspace. Their clients lose access.
  • A shared credential they supplied is cleared for an admin to authorize again.

A directory group can do this for you. Map a group to an access profile. A membership change in Okta or Entra moves people with nobody clicking.

The group can come from SCIM, a SAML assertion, or an OIDC token. Granting access by directory group.