> ## Documentation Index
> Fetch the complete documentation index at: https://ona.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Guardrails

> Understand the identity, policy, enforcement, and audit controls that govern Ona environments and agents.

1 0 3 f a 1 0 b 9 c 2 e 7 0 d
a 5 1 0 d 7 e 2 8 1 f 3 0 b 4
0 1 c 6 0 1 b 3 f 0 a 9 d 1 7
7 e 0 1 a 4 1 0 d 9 5 0 c 8 1
1 0 8 b 3 0 1 f 5 0 e 6 a 0 2
d 1 0 9 c 6 0 a 1 e 0 b 3 7 f
0 4 1 f 0 1 7 b 0 2 d 8 1 c 5
3 0 1 a e 0 1 d 8 0 4 f 6 0 9
1 b 0 5 1 0 c 9 0 f 7 1 a 3 e
6 0 1 0 7 a 4 0 1 e b 2 0 d 8
0 d 1 3 0 b 1 0 f 8 c 5 9 1 a
9 1 0 c 5 0 1 a 2 0 3 e 7 f 6
0 1 e 0 8 d 0 1 b 4 a 0 2 5 c
5 a 0 7 1 f 3 0 e 6 1 d 0 b 8
b 0 2 e 9 1 0 c 4 0 f 7 a 1 3
0 f 8 1 0 b 6 d 0 3 1 a 5 c 0
4 1 0 d a 0 9 1 7 e 0 2 b 0 f
1 c 3 0 f 8 0 5 1 a d 0 e 6 1
e 0 7 b 1 0 a 4 c 0 8 1 0 9 d
0 8 1 4 d 0 e 1 0 b 6 f 3 a 0

Introducing VetoKernel-level enforcement engine for AI agents. Block unauthorized executables below the agent's reach.

[Open](https://ona.com/docs/ona/guardrails/veto.md)

Guardrails are the controls that let teams adopt Ona without giving up administrative or security oversight. They span identity, organization policy, kernel-level enforcement, and auditability.

Use this section when you are answering questions like:

* who can access Ona and how they sign in
* what environments and agents are allowed to do
* which defaults apply across the organization
* how to investigate or explain agent behavior later

## What guardrails cover

Ona uses several layers of control:

| Layer | What it controls | Start here |
| - | - | - |
| Identity | Who can sign in and what access model you use | [SSO](https://ona.com/docs/ona/sso/overview.md), [SCIM](https://ona.com/docs/ona/scim/overview.md), [OIDC](https://ona.com/docs/ona/configuration/oidc.md) |
| Policy | Which defaults, limits, and restrictions apply across the organization | [Organization policies](https://ona.com/docs/ona/organizations/policies/overview.md) |
| Runtime enforcement | What can execute in an environment | [Veto](https://ona.com/docs/ona/guardrails/veto.md), [Command deny list](https://ona.com/docs/ona/command-deny-list.md) |
| Auditability | What happened, when, and under which identity | [Audit logs](https://ona.com/docs/ona/audit-logs/overview.md) |

## How to roll guardrails out

Most teams do not turn on every control at once. A practical rollout usually looks like this:

1. Connect [identity](https://ona.com/docs/ona/sso/overview.md) so access is tied to your existing org model.
2. Apply a small set of [organization policies](https://ona.com/docs/ona/organizations/policies/overview.md) for environment limits, lifecycle, and standardization.
3. Add runtime controls where you have clear risk boundaries:
   * [command deny list](https://ona.com/docs/ona/command-deny-list.md) for broad command restrictions
   * [Veto executable deny list](https://ona.com/docs/ona/organizations/policies/executable-deny-list.md) for kernel-level executable blocking
4. Review [audit logs](https://ona.com/docs/ona/audit-logs/overview.md) as part of rollout so admins know how to inspect outcomes and policy changes.

## Which controls to choose first

Start with the control that matches the risk you are trying to reduce:

* **Access and provisioning risk**: start with [SSO](https://ona.com/docs/ona/sso/overview.md), [SCIM](https://ona.com/docs/ona/scim/overview.md), and [organization roles](https://ona.com/docs/ona/organizations/organization-roles.md)
* **Resource sprawl or inconsistent setups**: start with [organization policies](https://ona.com/docs/ona/organizations/policies/overview.md)
* **Risky commands or binaries**: start with [command deny list](https://ona.com/docs/ona/command-deny-list.md) or [Veto executable deny list](https://ona.com/docs/ona/organizations/policies/executable-deny-list.md)
* **Compliance and post-incident review**: start with [audit logs](https://ona.com/docs/ona/audit-logs/overview.md)

## Related pages

* [Veto overview](https://ona.com/docs/ona/guardrails/veto.md)
* [Organization policies](https://ona.com/docs/ona/organizations/policies/overview.md)
* [Identity](https://ona.com/docs/ona/sso/overview.md)
* [Audit logs](https://ona.com/docs/ona/audit-logs/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.