Pre-action decisions
Allow, block, warn, require approval, or attest before an AI agent acts.
Before the agent acts, CAVRA decides.
Runtime Authority for AI coding agents.
The Runtime Authority platform for governing AI coding agents across software delivery.
CAVRA delivers policy enforcement, verifiable evidence, and AI Security Posture Management before autonomous actions execute. Built-in AISPM continuously measures AI operational risk and governance readiness.
Demo mode uses public sample data. Self-hosted operators connect providers; CAVRA Managed and Enterprise Subscription paths support live repositories, tenants, reports, connectors, and runtime evidence streams.
Agent intent
Policy
Evidence
AISPM
Why Enterprises Deploy CAVRA
Business outcomes first, runtime mechanics underneath.
CAVRA gives executives a defensible way to adopt AI coding agents: reduce unsafe autonomous behavior, preserve engineering speed, and produce evidence that security and audit teams can actually review.
Agent intent
Runtime Authority
AISPM
Board evidence
Key Point: CAVRA turns AI-agent governance into measurable risk reduction, delivery confidence, and audit-ready evidence.
Pre-actionDecisions before execution
Policy-backedFiles, shell, Git, MCP, IaC
Audit-readyEvidence and attestations
AISPMPosture, findings, readiness
Why Enterprises Deploy CAVRA
Make AI-assisted engineering governable without turning automation off.
Policy enforcement
Apply controls to files, commands, pull requests, infrastructure, MCP tools, and releases.
Audit evidence
Generate signed bundles, attestations, control mappings, and review-ready records.
AI security posture
Show coverage, findings, exceptions, open risks, and production-readiness blockers.
Key Point: CAVRA lets teams keep useful AI automation while forcing high-risk actions through clear decisions and evidence.
Executive readiness
Board packet, Report Center, and AISPM posture are evaluation deliverables, not afterthoughts.
Executive reviewers can start with outcomes, sample evidence, board-level posture, and report artifacts before moving into architecture or deployment.
Key Point: The first evaluation path is evidence review: posture summary, report center, board packet, and trial closeout.
How it works
Four control moments before a risky action completes.
1Agent proposes actionRead, write, execute, merge, deploy, or call a tool.
2CAVRA evaluates contextActor, target, repository, policy, trust, blast radius.
3Decision is returnedAllow, block, require approval, or attest.
4Evidence is recordedAudit bundle, control map, posture signal, report input.
Key Point: CAVRA makes the governance decision before the risky action completes.
Product paths
Choose the adoption path that matches how you want to operate CAVRA.
Community is the full self-hosted product, Managed is hosted CAVRA, Enterprise Subscription adds commercial support and certified packs, and Trial access lets evaluators prove one guided use case.
Key Point: Community is real self-hosted CAVRA; Managed and Enterprise Subscription add operated service and commercial support paths.
Product Demonstration Environment
Explore the demo console with clear public, configured, and managed boundaries.
The hosted site is a public Community-safe sandbox. It demonstrates the product model without exposing private tenant data, secrets, connectors, managed-service code, or commercial package internals.
Key Point: The public demo is safe to inspect; private runtime evidence and production connectors require configured providers, Managed operation, or approved trial access.
Downloads
Evaluation collateral in one place.
Download public-safe product briefs, sample evidence, architecture references, readiness packets, and trial guides to support CISO, board, audit, platform, and procurement review.
Key Point: Buyers should not hunt through the site; every evaluation artifact starts from this download shelf.
Next steps
Follow a clean evaluation journey.
Key Point: Run the demo, inspect evidence, review the board packet, then request guided Trial access.
AI Security Posture Management
AISPM turns agent activity into posture, evidence, and readiness decisions.
Community includes AISPM surfaces, report catalogs, and readiness contracts. Self-hosted production requires providers; CAVRA Managed operates live ingestion, streaming, report delivery, tenant operations, and production gates.
DiscoverAssessDecideEvidenceReport
Executive readiness
Pilot Launch Board Pack
A public-safe view of launch decision artifacts: scope, exceptions, risk acceptance, evidence room, report readiness, and go/no-go status.
CSO and audit reporting
Report Center
Download public demo reports. Configured self-hosted deployments or CAVRA Managed render scheduled PDF/XLSX packs, recipient-governed delivery, immutable audit evidence, and signed exports.
Report Delivery Provider
SMTP/provider settings, recipient allowlists, retention, and delivery audit logs require self-hosted configuration or CAVRA Managed.
Trial path
AISPM guided labs and Trial Field Guide
Evaluators can request time-limited CAVRA Trial access, follow the Trial Field Guide, run a complete AI-agent use case, and close the trial with evidence, expiry, revocation, and feedback.
Enterprise architecture
One authority layer across agents, tools, repositories, CI/CD, cloud, and audit.
CAVRA separates the decision plane, identity and trust plane, evidence plane, and AISPM posture plane so teams can govern agentic automation consistently.
Policy enforcement
Deterministic controls for risky AI-agent actions.
Example: an agent attempts to modify an IAM admin role. CAVRA evaluates the actor, target, branch, environment, tool trust, and blast radius, then blocks or routes for approval.
Evidence collector
Every decision becomes durable review material.
Evidence records explain who acted, what was requested, why CAVRA allowed or blocked it, which controls applied, and what an auditor can verify later.
Run the public demo to generate a sample evidence packet.
Use cases
Practical control points for AI-assisted engineering.
Role paths
Different readers get a clear path through the product.
CAVRA Trial
Request approved access, receive time-limited evaluator entitlement, and prove one complete AISPM use case.
The trial portal handles evaluator intake and operator review. Approved evaluators receive hosted or package access where applicable, evaluator entitlement, a guided lab, and closeout evidence.
Trial flow
- Submit evaluator request.
- Operator approves access.
- Run guided AISPM lab.
- Export evidence and closeout.
- Entitlement expires or is revoked.
Integrations
Ready and planned control surfaces are separated clearly.
Compliance and audit
Map decisions to controls without overstating certification.
Mappings support evidence collection and review. They do not by themselves certify an organization against a framework.
Roadmap
Community, Managed, Enterprise Subscription, and Trial access workstreams.
Documentation
Start with the CAVRA textbook, then run the public sandbox.
The GitHub Wiki e-book is the long-form guide to CAVRA architecture, product paths, CLI, GUI, AISPM, deployment, and operations.
Recommended reader path
- Read the Wiki textbook overview.
- Run the public demo from this site.
- Review policy and evidence examples.
- Request CAVRA Trial access for guided AISPM labs.
- Use the Trial Field Guide to prove one end-to-end use case.