Neutral. Cross-stack. Deterministic.
No cloud lock-in. No external services on the decision path. No LLM judging another LLM. Verun runs wherever your agents run — and authorizes their actions inline, with negligible overhead.
One gateway. A three-layer engine.
Verun Proxy / Sidecar
Policy — Can it?
Tools, thresholds, default-deny
Behavior — Does it usually?
Per-agent baseline · anomalies
Mission — Should it?
Off-topic tripwire
Decision
ALLOW / HOLD / BLOCK / ESCALATE
Enforcement mode
observe → hold_only → full
Signed receipt
Tamper-evident, async write
OTEL span
Additive, non-blocking
Receives the original request. Never sees blocked actions.
Approve once · or promote to a standing rule
Per-Agent Behavioral Baseline Store
Every action sharpens each agent's baseline. The more agents flow through Verun, the better the anomaly detection.
React + TypeScript
FastAPI (Python)
SQLite (local) / PostgreSQL (production)
receiptsSigned action decisions
baselinesPer-agent behavioral profiles
missionsDeclared agent mandates
policiesConfigured policy rules
Every choice made with intent.
No LLM on the decision path
Using an AI to judge another AI's actions reintroduces bias, non-determinism, latency, and bypassability. Verun's decisions are deterministic — the same input always yields the same decision and the same stated reason. An LLM may help a human understand a decision; it never makes one.
Air-gapped capable
The decision path makes zero external calls, so Verun runs in fully isolated environments. Financial institutions and defense contractors can deploy on secure networks with no external egress required.
Three integration modes
Proxy (zero code changes), Sidecar (K8s network-layer interception via Envoy/Istio ext_authz), and SDK (explicit instrumentation). The proxy model means every agent framework works — they all speak HTTP.
Enforcement mode graduation
Shadow mode lets tenants observe Verun's decisions before any blocking occurs. Graduate from observe → hold_only → full at your own pace. No team deploys blocking infrastructure cold.
Policy mining from observations
After observing real traffic, Verun mines the recorded decisions into a draft policy — an allowlist of the actions your agents actually use, sensible thresholds from what it saw, and default-deny for the rest. Deterministic and explainable, every rule backed by evidence, no LLM. You review and approve.
Behavioral + mission engine
Beyond policy, a per-agent baseline scores each action for behavioral anomalies (velocity, first-seen targets, unusual sequences) while a semantic mission anchor flags drift off the declared purpose. Both are deterministic and both hold rather than silently block.
Receipts as a first-class output
Every decision is a signed, tamper-evident, replayable record — which layer decided and why, under which policy version. Receipts export as Governance Evidence Packs and emit OpenTelemetry spans to any OTLP backend.
The moat is execution and data.
Verun's advantage isn't a single feature — it's the combination. A deterministic engine that's explainable and auditable, behavioral baselines that compound with every decision, and a neutral position across every model provider.
All three are live today and get stronger with usage.
Deterministic engine
LiveNo LLM on the decision path. Same input, same verdict, same reason — the only stance defensible to a regulator.
Compounding decision data
LiveEvery allow, hold, block, and human ruling sharpens the per-agent baselines. The advantage grows with usage.
Neutral & cross-stack
LiveGoverns agents on OpenAI, Anthropic, or local models — a position single-cloud vendors can't hold neutrally.
Works with your existing stack.
The proxy model means any agent framework works — they all speak HTTP. One environment variable points agents at the Verun gateway.
LangGraph
Proxy + SDKCrewAI
ProxyAutoGen
ProxyOpenAI / Anthropic
ProxyMCP clients
MCP gatewayn8n / Make / Zapier
No-code nodeEnvoy / Istio
Sidecar ext_authzAny HTTP agent
One-line callOpenTelemetry
Receipt exportThe gateway intercepts agent HTTP traffic transparently. No framework-specific connectors required.
We check the action, not the content.
Two questions every buyer asks: what does Verun actually receive, and does our data leave our environment? Straight answers.
Action metadata — not your content
Verun evaluates the action: agent id, action type, target, and parameters (amount, recipient, resource). It does not need your conversations, documents, or customer PII to make a decision. Sensitive fields can be hashed or redacted before they ever reach the engine.
Runs inside your boundary
If data leaving is a red line, you don't send it anywhere. Verun deploys as a self-hosted container — in your VPC or fully air-gapped. Nothing crosses the line, and receipts stay with you under your own controls.
On the honest cert story: we're not SOC 2 or ISO certified yet(both are on the roadmap). If data leaving is a red line, that's moot — run Verun in your own environment and your data stays under your controls.
Built to satisfy your auditors.
Verun's controls and evidence map to the governance frameworks enterprises are measured against — see the alignment.