guides
Intended Documentation
Runtime Integrations
Choose how to put Intended in the path of an agent runtime — submit intents directly, govern through a fail-closed adapter, or intercept tool calls at the gateway — without weakening fail-closed enforcement.
Runtime Integrations#
Intended is the authority plane for agent runtimes — it does not replace the runtime. It evaluates a proposed action against policy, returns a decision, issues a signed Authority Token on approval, and records the outcome in the audit chain. This page helps you pick the integration path that fits how much of the runtime you control.
Three patterns#
1. Submit intents directly#
Use this when your code runs before the action and can call the API.
- Submit the action to
POST /intent. - Read the decision:
APPROVED(200),ESCALATED(202), orDENIED(403). - On
APPROVED, present and verify theauthorityDecisionTokenat execution time. - The execution result is recorded in the audit chain.
This is the strongest path when you own the integration code. See the API Quickstart and Connector SDK.
2. Govern through a fail-closed adapter#
Use this when the runtime has its own execution boundary and you need a translation layer that proves authorization before acting.
- Intended evaluates the requested action and issues a token.
- A connector built on
BaseAdapterverifies that token — signature, tenant, adapter, target, expiry, single-use nonce — and only then performs the action. - Validation is fail-closed; a bad or replayed token never executes.
This is the Connector SDK pattern, and the shape the OpenShell / NemoClaw policy-compilation flow targets.
3. Intercept tool calls at the gateway#
Use this when actions arrive as model tool calls and you don't want to touch agent code.
- Point the agent's model base URL at the LLM gateway.
- The gateway evaluates each tool call once and applies the decision (forward / deny-rewrite / escalate-rewrite).
- Runs in
observefirst, thenenforce.
Current runtime surfaces#
| Surface | Integration mode | Status |
|---|---|---|
| Anthropic / OpenAI / Bedrock / Vertex / NVIDIA NIM agents | LLM gateway | available |
| NVIDIA OpenShell / NemoClaw | policy compilation + adapter | reference integration |
| OpenClaw / Node agent harnesses | gateway via @intended/openclaw-plugin | available |
| Physical-AI runtimes (ROS2, Isaac Sim) | gateway for planning + on-robot token verifier | partial — see Roadmap notes |
| Your own service | direct intent submission | available |
Note
Roadmap. For physical-AI runtimes the gateway covers the LLM-planning layer today; the sub-50ms Rust edge verifier that gates actuation on-robot is not yet in the repo. Use the Go / Python (ROS2) verifiers in the meantime — see Verify Decision Tokens.
What Intended does — and does not — do#
Intended classifies and evaluates the action, applies your policy and risk thresholds, issues scoped Authority Tokens, supports escalation and approvals, and preserves audit lineage. It does not take ownership of a third-party runtime, modify its licensing or terms, guarantee the security posture of upstream alpha software, or remove your responsibility to harden the runtime, its credentials, and its allowed endpoints.
Choose your next step#
- LLM Gateway — govern tool calls with one env var.
- Connector SDK — build a fail-closed adapter.
- OpenShell / NemoClaw — compile runtime policy YAML.
- Third-party runtime boundaries — security model for upstream runtimes. </content>