> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sec0.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> How Sec0 integrates with your Agentic Application

# Overview

<Tip>
  Start with the [Quickstart](/docs/quickstart) if you want to jump into a working local integration fast.
</Tip>

Sec0 is an open-source SDK and runtime infrastructure for governing AI workflows with context-aware guardrails that evolve alongside your agents.

It captures and curates high-quality trajectory data from orchestrator decisions, agent actions, tool calls, policy outcomes, and human-in-the-loop interventions to support safe, continuous agent improvement.

It helps you reduce manual review by making the easy cases automatic:

* allow the actions that are clearly safe
* deny the actions that are clearly out of policy
* escalate only the actions that are genuinely high risk or ambiguous

As Sec0 learns from runtime outcomes and human review signals, the compliance controls become more precise so fewer actions need to be escalated to experts.

<div className="sec0-pie-charts">
  <div className="sec0-pie-block">
    <svg className="sec0-pie-svg" viewBox="0 0 200 200" role="img" aria-label="Allow 5%, Deny 8%, Escalate 87%">
      <path d="M 100.000 100.000 L 100.000 10.000 A 90.000 90.000 0 0 1 127.812 14.405 Z" fill="var(--sec0-allow)" />

      <path d="M 100.000 100.000 L 127.812 14.405 A 90.000 90.000 0 0 1 165.607 38.391 Z" fill="var(--sec0-deny)" />

      <path d="M 100.000 100.000 L 165.607 38.391 A 90.000 90.000 0 1 1 100.000 10.000 Z" fill="var(--sec0-escalate)" />

      <circle cx="100" cy="100" r="90" fill="none" stroke="var(--sec0-pie-stroke)" strokeWidth="3" />
    </svg>

    <div className="sec0-pie-legend">
      <div>
        <span className="sec0-swatch sec0-swatch-allow" />

        Allow 5%
      </div>

      <div>
        <span className="sec0-swatch sec0-swatch-deny" />

        Deny 8%
      </div>

      <div>
        <span className="sec0-swatch sec0-swatch-escalate" />

        Escalate 87%
      </div>
    </div>
  </div>

  <div className="sec0-pie-arrow-wrap">
    <div className="sec0-arrow-mermaid sec0-arrow-mermaid--h">
      ```mermaid actions={false} theme={null}
      %%{init: {'theme': 'base', 'flowchart': { 'rankSpacing': 220, 'nodeSpacing': 60 }, 'themeVariables': { 'fontSize': '24px', 'edgeLabelBackground': '#ffffff', 'lineColor': '#111827' }} }%%
      flowchart LR
        A["A"] -->|Sec0 self-improving compliance controls| B["B"]

        classDef ghost fill:transparent,stroke:transparent,color:transparent;
        class A,B ghost;
        linkStyle 0 stroke:#111827,stroke-width:3px;
      ```
    </div>

    <div className="sec0-arrow-mermaid sec0-arrow-mermaid--v">
      ```mermaid actions={false} theme={null}
      %%{init: {'theme': 'base', 'flowchart': { 'rankSpacing': 220, 'nodeSpacing': 60 }, 'themeVariables': { 'fontSize': '24px', 'edgeLabelBackground': '#ffffff', 'lineColor': '#111827' }} }%%
      flowchart TD
        A["A"] -->|Sec0 self-improving compliance controls| B["B"]

        classDef ghost fill:transparent,stroke:transparent,color:transparent;
        class A,B ghost;
        linkStyle 0 stroke:#111827,stroke-width:3px;
      ```
    </div>
  </div>

  <div className="sec0-pie-block">
    <svg className="sec0-pie-svg" viewBox="0 0 200 200" role="img" aria-label="Allow 60%, Deny 25%, Escalate 15%">
      <path d="M 100.000 100.000 L 100.000 10.000 A 90.000 90.000 0 1 1 47.099 172.812 Z" fill="var(--sec0-allow)" />

      <path d="M 100.000 100.000 L 47.099 172.812 A 90.000 90.000 0 0 1 27.188 47.099 Z" fill="var(--sec0-deny)" />

      <path d="M 100.000 100.000 L 27.188 47.099 A 90.000 90.000 0 0 1 100.000 10.000 Z" fill="var(--sec0-escalate)" />

      <circle cx="100" cy="100" r="90" fill="none" stroke="var(--sec0-pie-stroke)" strokeWidth="3" />
    </svg>

    <div className="sec0-pie-legend">
      <div>
        <span className="sec0-swatch sec0-swatch-allow" />

        Allow 60%
      </div>

      <div>
        <span className="sec0-swatch sec0-swatch-deny" />

        Deny 25%
      </div>

      <div>
        <span className="sec0-swatch sec0-swatch-escalate" />

        Escalate 15%
      </div>
    </div>
  </div>
</div>

The recommended application path is to decorate the hops you already own so Sec0 can enforce policy, propagate runtime context, and append audit records automatically at those execution points.

See [Core Concepts](/docs/concepts) for the in-device and network-boundary model.

## Why Sec0?

Modern agent systems cross more boundaries than the app code usually makes obvious:

* orchestrator to agent
* agent to agent
* agent to tool server
* tool server to external API or data source

That creates four recurring problems:

1. Too many actions still require manual review because it is not obvious which ones are clearly safe.
2. Runtime policy is scattered across agents, tools, and gateways, so the same rule is enforced inconsistently.
3. Adding new data sources, tools, agent connections, or a new model or orchestrator version changes the risk profile again. Each time the runtime changes, safety has to be re-evaluated from scratch.
4. When something goes wrong, there is no stable audit trail that explains who did what, with which context, and why it was allowed.

## How Sec0 Improves Agent Behavior

Sec0 does not evaluate rules against static policy alone.

Every rule check can use runtime context such as the acting `nodeId`, the current `runId`, the tool or target being accessed, the boundary being crossed, and the agent state propagated from earlier hops.

That context makes the decision layer more precise and gives you a usable improvement loop:

1. Sec0 captures runtime context at each hop.
2. Policy, Guard, and contextual evaluator checks use that context when deciding whether to allow, deny, redact, or escalate.
3. The resulting policy outcomes, findings, and human review decisions are written into the audit trail.
4. Those runtime findings and review signals can then be used to refine policy, tighten escalation rules, and make agent behavior safer and more predictable over time.

## Where Sec0 Fits

Sec0 has four integration layers.

| Layer                | What you add                                                                                                              | Primary surface                                              |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| App code             | Decorate the agent or orchestrator hops you already own, and add Guard only when an action leaves those hops              | `@sec0.agent()`, `@sec0.orchestrator()`, `sec0-sdk/guard`    |
| Middleware           | Decorate the tool boundary so Sec0 applies policy, context propagation, and audit automatically at the handler entrypoint | `@sec0.middleware()`, `@sec0.server()`, `@sec0.tool()`       |
| Network boundary     | Decorate the gateway or router boundary where cross-service calls are forwarded                                           | `@sec0.gateway()`                                            |
| Hosted control plane | Pull policy from the control plane, manage escalations, upload audit data, and wire approval channels                     | `@sec0/client-sdk`, `@sec0/hosted`, `@sec0/approvals-bridge` |

## What Reduces Human Review

Sec0 is not just a logging layer. It helps reduce review volume by combining:

* policy rules that catch the obvious deny cases
* guard rules that block or redact known-bad outbound content
* runtime evaluation that decides whether observed reasons should actually deny
* optional contextual evaluation through `sec0-sdk/evaluator` for ambiguous actions
* approvals and escalations only for the remaining high-risk cases

That is the reason the SDK surfaces matter: they let you place the decision point where the action actually happens.

## Next Steps

<CardGroup cols={2}>
  <Card title="Installation" href="/docs/installation">
    Install the current Sec0 surfaces and choose the right entrypoint
  </Card>

  <Card title="Quickstart" href="/docs/quickstart">
    Build a local integration with policy, guard, audit, and agent state
  </Card>

  <Card title="Middleware" href="/docs/middleware">
    Decorate the tool boundary where Sec0 should enforce policy automatically
  </Card>

  <Card title="Verify & Troubleshoot" href="/docs/verify-and-troubleshoot">
    Validate the integration and diagnose common issues
  </Card>
</CardGroup>