Skip to main content
By the end of this guide you will have ironrun installed, a policy file wired to your project, at least one secret stored in an encrypted local vault, and a working run_sealed tool that your AI agent can call to run commands without ever reading a credential value.

​
What to do next

  • Explore additional environments with ironrun new staging and switch between them with ironrun use staging
  • Learn about the full policy file reference — TTLs, no_network, seccomp filtering, and the audit log
  • Set up revocable agent leases for sensitive projects where you want to approve every individual command
  • Review the MCP tools reference to understand exactly what the agent can and cannot do