Bay Run trust and assurance
Evidence a human owner and delegated agent can use for a task-specific suitability decision.
Machine-readable form: https://run.huggingbay.xyz/.well-known/assurance.json
{
"agent_required_sequence": [
"minimize the input and exclude credentials",
"quote with explicit region, provider, external-API, retention, quality, latency, and price constraints",
"stop when the quote reports a constraint failure or lacks owner-required evidence",
"obtain human approval when owner policy requires it",
"execute with a least-privilege credential and a hard maximum price",
"verify the returned receipt and report its explicit limitations to the owner"
],
"assurance_status": {
"assessment_type": "implementation-backed self-assessment",
"certifications_claimed": [],
"customer_specific_review_required_for_restricted_data": true,
"independent_security_audit_completed": false,
"penetration_test_claimed": false,
"universal_safe_or_secure_claim": false
},
"build": {
"binding_status": "complete",
"generated_at": "2026-10-16T05:37:27Z",
"image_digest": "sha256:35d717008d59bb49f14a1bc77de38a72abdd9d3a80cbfe9bc5a45516e89a4a63",
"source_sha": "38573a833e2a2574b103018fc4e23b25b391bd69"
},
"decision_model": "task_specific_owner_authorized",
"effective_date": "2026-08-13",
"memory": {
"automatic_cross_tool_injection": false,
"automatic_memory_default_ttl_seconds": 2592000,
"credential_pattern_filter_is_general_dlp": false,
"customer_memory_used_for_training": false,
"deletion_requires_separate_owner_scope": "data:delete",
"details": "https://run.huggingbay.xyz/.well-known/data-policy.json",
"durable_free_key_principal_isolated": true,
"injected_memory_treated_as_untrusted_data": true,
"memory_failure_logs_include_raw_exception_text": false,
"oauth_demo_session_principal_isolated": true,
"owner_attested_memory_credential_required": true,
"principal_scoped": true,
"private_search_body_endpoint": "POST https://run.huggingbay.xyz/v1/memory/search",
"public_oauth_alone_sufficient": false,
"rag_context_prompt_injection_guard": true,
"shared_demo_warning": "The legacy configured static demo credential is shared and must not hold secrets or private memory. Zero-secret OAuth demo tokens use isolated token-scoped session principals; registered clients and bay_live_ keys use isolated identified principals.",
"ttl_delete_export_controls": true
},
"owner_decision_evidence": {
"data_policy": "https://run.huggingbay.xyz/.well-known/data-policy.json",
"free_quote": "https://run.huggingbay.xyz/v1/task/quote",
"health": "https://run.huggingbay.xyz/health",
"identity_introspection": "https://run.huggingbay.xyz/v1/identity",
"openapi": "https://run.huggingbay.xyz/openapi.json",
"pricing": "https://run.huggingbay.xyz/.well-known/pricing",
"receipt_verification": "https://run.huggingbay.xyz/v1/provenance/verify",
"security_contact": "https://run.huggingbay.xyz/.well-known/security.txt",
"security_policy": "https://run.huggingbay.xyz/security"
},
"schema": "bay-run.assurance.v1",
"service": "bay-run",
"software_supply_chain": {
"continuous_vulnerability_monitoring_claimed": false,
"limitation": "The dependency audit is a point-in-time release gate, not an independent assessment, SBOM attestation, or guarantee against later disclosures.",
"release_dependency_audit": "pip-audit against the pinned production requirements",
"runtime_requirements_pinned": true
},
"standards_mapping": [
{
"certification": false,
"evidence": "https://run.huggingbay.xyz/.well-known/security.txt",
"limitation": "Publication and RFC 9116 syntax do not independently verify mailbox delivery, alerting, monitoring, or response time.",
"reference": "RFC 9116",
"reference_url": "https://www.rfc-editor.org/rfc/rfc9116.html",
"scope": "machine-readable vulnerability disclosure contact",
"status": "implemented_contact_surface"
},
{
"certification": false,
"implemented_controls": [
"authorization-code PKCE",
"exact redirect comparison during token exchange",
"durable atomic one-time authorization-code consumption",
"confidential-client authentication during code exchange",
"strict scope and resource allowlists with audience-bound access tokens",
"short-lived access tokens without unbound refresh tokens",
"trusted-client-IP throttling on pre-authentication OAuth endpoints",
"authorization-server metadata",
"least-privilege resource scopes",
"owner-management scopes excluded from public OAuth authorization",
"public demo principals are ephemeral and cannot administer developer credentials",
"durable credential administration requires confidential-client authentication"
],
"known_gaps": [
"bearer access tokens are not sender-constrained",
"the auto-approved authorization-code flow is not human login or consent"
],
"reference": "RFC 9700 OAuth 2.0 Security BCP",
"reference_url": "https://www.rfc-editor.org/rfc/rfc9700.html",
"status": "partial"
},
{
"certification": false,
"implemented_controls": [
"tenant predicates on task and memory object access",
"separate function-level owner, spend, deletion, and execution scopes",
"bounded request schemas, rate limits, idempotency, and hard price ceilings",
"strict Host allowlist and no ambient forwarded-header trust",
"fail-closed payment settlement and nonchargeable unusable outputs"
],
"limitations": [
"This mapping is not an OWASP certification or independent audit.",
"Database row-level security is not claimed."
],
"reference": "OWASP API Security Top 10 2023",
"reference_url": "https://owasp.org/API-Security/editions/2023/en/0x11-t10/",
"status": "self_assessed_control_mapping"
},
{
"certification": false,
"implemented_controls": {
"govern": "human-owned authorization, spending, retention, and route-switch policy",
"manage": "fail closed on conflicts, preserve receipts, and require owner approval where configured",
"map": "task-specific schemas, constraints, provider and data-policy declaration",
"measure": "candidate quality, latency, cost, failure, and provenance evidence"
},
"limitations": [
"Use of the voluntary framework is not certification.",
"The task owner remains responsible for context-specific risk acceptance."
],
"reference": "NIST AI RMF 1.0",
"reference_url": "https://www.nist.gov/itl/ai-risk-management-framework",
"status": "informative_mapping"
},
{
"certification": false,
"implemented_controls": [
"identify and communicate current processing and subprocessor facts",
"owner-selected retention and external-provider constraints",
"data minimization, scoped deletion or redaction, and no-training default",
"transport and managed at-rest encryption claims with explicit assurance limits"
],
"limitations": [
"This is not a NIST assessment, certification, or legal compliance opinion."
],
"reference": "NIST Privacy Framework",
"reference_url": "https://www.nist.gov/privacy-framework/privacy-framework",
"status": "informative_mapping"
}
],
"summary": "Bay Run publishes evidence for a human owner and delegated agent to decide whether a specific task fits the declared data, provider, region, retention, spending, and verification controls. It does not claim universal safety."
}