Runtime Playbooks
Governance · Runtime overview · Foundation →
Implementation guides for Policy-Governed Agent Runtime. The Runtime blueprint is the reference design. Estate how-to: Operating. These playbooks are the how for the request path: contracts, enforcement, boundaries, and tests.
RAG, tool manifests, and memory are other G.A.I.N subjects. PGAR gates their side effects. Their how-to lives in RAG, Agents: Manifests, and Memory.
The LLM proposes. The PEP enforces. The PDP decides. Every side effect gates at the PEP before downstream runs. These playbooks show you how to build that path.
Three playbook groups
| Group | Overview | What you build |
|---|---|---|
| Foundation | Open → | SARAC contracts, token custody, PEP/PDP loop, step-up, audit replay |
| Assurance | Policy test scenarios | Golden authorization cases in CI, adversarial bypass tests |
| Boundary | Open → | Five trust boundaries from ingress through downstream |
Plus Further reading (external) for third-party PDP/PEP and OAuth patterns mapped to this series.
Recommended path
- Foundation (6 playbooks): policy contracts → token & session → PEP → PDP → step-up → audit
- Assurance (2 playbooks): scenario library and adversarial bypass set (start in parallel once PEP exists)
- Boundary (5 playbooks + overview): ingress, agentic app, LLM proposal, PEP + PDP, downstream
Then call other G.A.I.N series for the thing being gated: Manifests, RAG, Memory.
Eval overlap: Action plane · Tool plane.
All playbooks at a glance
Foundation
| Playbook | One-line purpose |
|---|---|
| Policy contracts | SARAC payload shapes the PDP evaluates |
| Token & session | Credentials stay out of the LLM boundary |
| PEP enforcement | Receive, ask PDP, audit, act on every proposal |
| PDP surfaces | ALLOW, DENY, STEP_UP rule authoring |
| Step-up & attestation | Re-eval after human approval |
| Audit & replay | Immutable verdict chain for examiners |
Assurance
| Playbook | One-line purpose |
|---|---|
| Policy test scenarios | Representative, edge, and incident replay cases in CI |
| Adversarial testing | Direct downstream bypass, injection, shadow tools |
Boundary
| # | Playbook | One-line purpose |
|---|---|---|
| ① | Ingress | Token validation and claims at the edge |
| ② | Agentic app | Orchestration, token custody, validation gates |
| ③ | LLM proposal | Tool schemas only; proposal not permission |
| ④ | PEP + PDP | Verdict before any side effect |
| ⑤ | Downstream | Re-auth, execute, return to app |
See Boundary overview for request flow and multi-agent patterns.
Cross-calls (not nesting)
| Side effect | G.A.I.N subject | Playbook |
|---|---|---|
| Tool execute | Agents | Manifest registry |
| Corpus retrieve | RAG | RAG retrieval |
| Prefs / episodes | Agents | Memory |
PGAR still evaluates SARAC on those actions. The store and contract live in the subject series.
Who should read what
| Role | Start with | Then |
|---|---|---|
| Security / IAM | Token & session, Ingress | PDP surfaces, Audit & replay |
| AI platform | PEP enforcement, Agentic app | MCP, RAG |
| Governance / compliance | Policy contracts, Audit & replay | Policy test scenarios · Operating |