MAELYS//WARDEN

Policy-enforced process runtime

MaelysWarden

DEFINE · ENFORCE · ATTEST

Maelys product · v0.41.0 · 2026-08-28 · release →

The world is sealed before the process is born.
What follows can only unfold within it.

Run AI agents, developer tools and OCI workloads with only the files and network access they need. Warden compiles one portable policy, selects a backend that can enforce it, supervises the full lifecycle and emits verifiable execution evidence.

[ ISOLATE ]Run untrusted tools safely
  • restrict what they can read
  • control what they can change
  • block everything else
[ PORTABLE ]One policy, multiple enforcement layers
  • Seatbelt and Bubblewrap
  • Apple Container and Krun microVMs
  • native arm64 and translated OCI workloads
[ CONTROL NETWORK ]Allow only what is needed
  • block network access by default
  • mediate approved destinations through Egress
  • support standard and Maelys-aware tools
[ ACCOUNTABLE ]Know exactly what happened
  • seal policy and artifact identities
  • record selected enforcement layers
  • capture lifecycle and final outcome
macOSApple Silicon
Linuxarm64 + amd64
LOCAL + CONTAINERSone policy
FAIL CLOSEDnever silently weakened
SIGNEDverifiable releases

Protection

What Warden does for you

RULES

Say what the process may do

Choose read-only or read-write access, then add only the files and destinations the command truly needs.

--ro · --rw · --allow-read · --allow-write
FILES

Protect the host filesystem

The workload sees a deliberately limited view instead of inheriting access to your whole machine.

workspace in · private files out
NETWORK

Open approved destinations only

Keep the network closed by default, or allow the exact services required by the task.

--net github.com:443
SUPERVISION

Stay in control of the whole run

Warden starts, watches, stops and cleans up the workload as one bounded operation.

start → watch → stop → clean up
RECORD

Keep a verifiable execution record

See which protection was selected, which rules were enforced and how the command ended.

--receipt run.json
INTEGRATE

Use it your way

Start from the command line, embed the C library, or automate runs from Python and Node.js.

CLI · C · Python · Node.js

Architecture

One decision, enforced end to end

ARCHITECTUREFrom your intent to a controlled execution
    • Policy sourceinline flags, JSON or canonical MIR
    • Trusted RunSpectarget + MIR + deployment context
    • Candidate plannerSeatbelt, Bubblewrap, Apple Container or Krun
    • Enforcement layersfilesystem, network and bounded lifecycle
    • Receipt v1, v3 or v4digests, selection, layers and outcome
  • Policy source → Trusted RunSpec
  • Trusted RunSpec → Candidate planner
  • Candidate planner → Enforcement layers
  • Enforcement layers → Receipt v1, v3 or v4

You define one portable boundary. Warden considers only candidates that can enforce every required capability, refuses silent degradation, and records the selected layers plus terminal outcome.

Quick start

Install and run

PLATFORMNative packages

Apple Silicon, macOS 15+

Install the native runtime, then place any command behind a read-only or read-write workspace boundary.

brew install maelys-dev/tap/maelys-warden
maelys-warden run --ro -- codex