Skip to content
ZeravaDocs

The first day

2. The first day

Section titled “2. The first day”

For the first operator. About one hour.

The example. Ana runs IT for a small accounting office. Their AI agent sorts incoming mail, drafts replies and files documents. By the end of her first day with Perun, every call that agent makes goes through Perun, Perun knows which of the agent’s tools can do damage, and a test attack has shown her what Perun catches.

The steps.

  1. Install Perun on the computer where your agent runs. On Ubuntu or Debian, install the .deb you received; on Windows, run PerunSetup. Perun starts by itself whenever you log in and keeps running in the background.

  2. Become the first operator. perun operator add <your name>, then perun login <your name>. First, perun mail setup: Perun sends its few emails (codes and reports to bosses) only through your company’s own mail server. Then Perun asks for your boss’s email address. Every operator has a boss: when an operator drifts too far from their mission, Perun reports it to that person. If you own the company, give the address of another responsible person, such as a partner or your accountant. Perun sends that person an email with a code; you are registered once you type the code in. The same email gives your boss a seal: a short word that every later report from your Perun will carry, so they know it is genuine. The order of first login sets the hierarchy among operators. You are first; the next person to log in is second, and so on. A lower rank can never change a higher rank’s answer.

    Then do the practice (perun practice, or the Practice tab): a short, measured exercise with harmless held calls, two questions to SHARED_LIB and one declaration. It never touches real work. Until you have done it, Perun does not let you answer real held calls. The operator’s textbook (free to download) prepares you for it. Every operator after you does the same; you and they see their profile.

  3. Give Perun your model key. Put your model provider’s API key into Perun’s settings once (perun paths shows where the settings file is). From then on your agent does not need to hold the real key.

  4. Point your agent at Perun. This is the only change in your agent. Set its base URL to:

    • http://127.0.0.1:8787/v1 for OpenAI-compatible models, or
    • http://127.0.0.1:8787/anthropic for Anthropic. Nothing else changes. Your agent works as before; its calls now pass through Perun.

  5. Let the agent work for a few minutes, then look at what Perun proposes: perun proposals, or the Declarations tab in perun screen. For every tool your agent offered, Perun drafts a declaration from the tool’s name and parameters: can it be undone or not, and what kind of destination it is (files, shell, database, web address, messages). Check each draft and accept it, adding the mandate where Perun asks: which folders the file tool may touch, which hosts the web tool may call, which domains mail may go to. Until you accept declarations, Perun does not know which actions are irreversible, so it holds nothing. This step is what turns Perun from a watcher into a guard.

  6. Switch on the meter. perun meter init. Perun shows the fingerprint of its SHARED_LIB; confirm it. From now on the meter checks that SHARED_LIB is the real one and is doing its job, and it tells you if not.

  7. Open the screen. perun screen. On Status, read both columns: what Perun protects, and — just as visible — what it does not. On Coverage, each of the nine attack types shows configured or not configured, with the next step.

  8. Run the test attack. The Test attack tab sends harmless samples of what Perun must catch. They never reach your agent or your model. Every line should say caught.

What to expect in the first days. Perun treats every new source and every new tool as unknown until it has seen it enough (thirty times), so for a while it will hold irreversible actions and ask you. This is on purpose: a stranger’s first request to send money or delete files should reach a human. You can shorten it for a source you know well by declaring it trusted (perun trust <source>). The questions become rarer as Perun learns your agent’s normal work.

The rule. On the first day you give Perun three things it cannot guess: who answers for it (you and your boss), what your agent’s tools can do (the declarations), and which SHARED_LIB is yours (the meter). Everything Perun decides later rests on these three.

Checklist for the end of the first day

  • ☐ I am the first operator; my boss confirmed the code; I did the practice.
  • ☐ The model key is in Perun; the agent’s base URL points at Perun.
  • ☐ Every proposal is accepted or dismissed; the irreversible tools have their mandate.
  • ☐ The meter is on and I confirmed the fingerprint.
  • ☐ Status and Coverage read; the test attack shows caught everywhere.