Open Source · Deployment patterns
Choose the narrowest boundary you actually control.
RuleOak v0.50.0 is not a hosted control plane. It runs at local or application-owned cooperating boundaries.
Node.js SDK
Best when you own the function/tool registry. Strongest control over normalized identity, policy, one-use authority and result capture.
SDK guide →MCP Streamable HTTP
Proxy a supported endpoint, with explicit authentication and transport assumptions.
HTTP boundary →Loopback REST
Expose authorization decisions to another local runtime. Non-loopback deployment changes the threat model.
Operator CLI
Setup, inspection, approvals, reconciliation, evidence, CrashLab and release diagnostics.
Before calling a route protected
- name the exact interception point;
- identify bypass paths;
- prove deny prevents executor invocation;
- prove one-use authority rejects replay;
- define what becomes effect evidence;
- state whether trusted postcondition semantics exist;
- exercise timeout/restart/stale-policy cases.