See RuleOak decide before execution

1. Run the 60-second demo

npx @ruleoak/cli@latest demo quickstart

The demo makes no destructive or external calls. It shows ALLOW, NEEDS_APPROVAL, and DENY, then writes local evidence and an offline HTML report under .ruleoak-demo-output/.

2. Protect an existing Node.js process

npx @ruleoak/cli@latest protect -- node agent.js

RuleOak can initialize a conservative workspace, recommend a policy pack, run diagnostics, intercept supported stdio/JSON-RPC tool calls, surface approvals, consume one-time grants, and write evidence.

ruleoak protect --learn -- node agent.js
ruleoak protect --approval-mode prompt -- node agent.js
ruleoak protect --policy-pack mcp-server-safe -- node mcp-server.js

3. Inspect the local workspace

ruleoak doctor
ruleoak workspace status
ruleoak policy lint
ruleoak replay --verify

4. Review approvals and policy suggestions

ruleoak approve
ruleoak approve inbox
ruleoak learn summary
ruleoak learn review

Persistent approval choices and learning mode can produce reviewable suggestions. They do not silently broaden active policy.

5. Add the Node.js SDK

npx @ruleoak/cli@latest init --dir . --policy-pack cautious
npm install @ruleoak/core

import { readFile } from 'node:fs/promises'
import { createRuleOak } from '@ruleoak/core'

const ruleoak = await createRuleOak({ workspace: '.' })
const guardedRead = ruleoak.guardFunction({
  name: 'filesystem.read',
  category: 'file',
  operation: 'read',
  resource: ([path]) => path,
  scope: 'local',
  sensitivity: 'public',
  execute: readFile
})

console.log(await guardedRead('./README.md', 'utf8'))

The executor is called only after RuleOak allows the action and, in execution-aware flows, after the one-time grant is consumed.

6. Choose another supported integration path