Common questions.

Yes — there's a hosted, clickable demo. A support-desk agent proposes a $400 refund, Verun holds it, a human approves it in the operator console, and Verun executes the refund itself with a signed receipt. It's real (not a mockup). Start with the guided walkthrough at verun-refund-demo-store.fly.dev/guide, try the Support Desk at verun-refund-demo-store.fly.dev, and approve the hold in the Operator console at verun-refund-demo.fly.dev (login admin / verun2026!).

Verun is an action control gateway. Before any consequential AI agent action executes — issuing a refund, sending a message, running a command, moving money — the action passes through Verun. It evaluates the action against three layers: policy (can it?), behavior (is this normal for this agent?), and mission (is it still on purpose?), then returns one of four decisions: ALLOW, HOLD, BLOCK, or ESCALATE. Every decision is stored as a signed, tamper-evident receipt.

Most tools ask whether an agent is allowed to do something. Verun also asks whether it's normal for this agent and whether it's still on mission. It builds a per-agent behavioral baseline and flags velocity bursts, first-seen targets, cross-domain behavior, and unusual sequences — UEBA for agents. That behavioral memory is what others govern around but don't have.

Observability is retrospective — it shows you what happened after execution. Verun is prospective — it authorizes before execution proceeds. They're complementary: Verun emits signed receipts and OpenTelemetry spans that your observability stack can ingest.

No. Guardrails screen prompts and outputs — text — and rely on a probabilistic model that can be bypassed. Verun governs actions: the consequential tool-calls an agent makes. And there is no LLM on its decision path, so decisions are deterministic and explainable.

They'll own the gateway and policy plumbing. They're not structurally positioned to own neutral, per-agent behavioral memory across OpenAI, Anthropic, local models, and many frameworks at once — that's a conflict of interest for a single-cloud vendor. Verun is the neutral behavioral product on top, and its baselines compound with every decision and human ruling — a data advantage that grows with usage.

No. Verun.ai — behavioral runtime governance for AI agents — is not verun.dev (an unrelated open-source coding workspace), verun.app, or “Verum AI.” If you're looking for the action control gateway that authorizes what AI agents do before they execute, you're in the right place: verun.ai.

Using an AI to judge another AI's actions reintroduces the exact problems you're trying to govern: bias, non-determinism, latency, and bypassability. Verun's decisions are deterministic — the same input always yields the same decision and the same stated reason. It's the only stance defensible to a regulator. An LLM may help a human understand a decision; it never makes one.

Decisions run inline on the gateway path and add only tens of milliseconds. There are no external API calls, no LLM inference, and no probabilistic scoring on the decision path — which is what keeps the overhead negligible and the result deterministic.

ALLOW (proceed), HOLD (pause for human review), BLOCK (refuse), and ESCALATE (push to a human immediately). Behavioral and mission signals hold rather than silently block — so a false positive costs one human review, not a broken workflow.

No. The decision path makes zero external calls, so Verun runs in fully air-gapped environments. No data leaves your perimeter — no third-party APIs, cloud telemetry, or external services of any kind.

From a single HTTP call to a drop-in proxy to an MCP gateway. Proxy: point OPENAI_BASE_URL at the Verun gateway — zero application code changes. Sidecar: Envoy/Istio ext_authz for network-layer enforcement in Kubernetes. SDK: an explicit verun.authorize() call, Python stdlib only, zero dependencies. MCP gateway: govern tool-calls at the protocol layer. Any agent that speaks HTTP works out of the box.

Yes. There are Verun nodes for no-code workflow tools (n8n, Make, Zapier), so automations built by ops teams get the same authorize → hold → approve path as coded agents. And Verun can run as an MCP gateway, governing tool-calls at the Model Context Protocol layer without per-agent wiring.

Yes — that's the lowest-friction on-ramp, "Verun Light." Any agent or chatbot can self-check by calling one Verun HTTP endpoint from its own instructions before it takes a consequential action, then obeying the decision. Be clear-eyed about the trade-off: it's opt-in and cooperative — the agent has to choose to call it, so it can be bypassed. It's great for governing your own agents, not for adversarial enforcement. When you need enforcement that can't be skipped, use the SDK, proxy, sidecar, or MCP gateway. Verun Light is currently in testing with a small closed community.

Shadow mode (enforcement mode: observe) runs Verun passively. The three layers evaluate and receipts are written, but the action is always allowed. The decision Verun would have made in full mode is recorded on the receipt, so you can review exactly what would have happened before graduating to hold_only or full enforcement.

Policies are JSON, per tenant: allowed and blocked tools, thresholds, environment restrictions, and mandatory-approval rules, with default-deny. They hot-reload without restart. Held decisions can also be promoted to standing rules from the review queue.

Verun evaluates the action, not your content. It receives the action's metadata — agent id, action type, target, and parameters (amount, recipient, resource) — which you can hash or redact. It does not need your conversations, documents, or customer PII. And if data leaving is a red line, you run Verun inside your own environment: a self-hosted container, in-VPC, or fully air-gapped. Nothing crosses the line, and receipts stay with you under your own controls.

Not yet — both are on the roadmap, and we won't claim otherwise. Importantly, if data leaving your environment is the concern, certification is moot: you self-host Verun, so your data stays under your controls. This is the same honest framing as our Standards page — we're designed to support these frameworks, not claiming to be certified against them.

A signed, tamper-evident, replayable record of every decision — the action, target, which layer decided and why, the behavioral and mission signals, the policy version, and a timestamp. Receipts are queryable via the API or console and export as Governance Evidence Packs (JSON/PDF) for auditors.

Verun is designed to support — not replace — Gartner AI TRiSM, the EU AI Act, ISO/IEC 42001, SOC 2, NIST AI RMF, and OWASP LLM Top 10, by providing the runtime controls, human oversight, traceability, and evidence those frameworks call for. See the Standards page for the mapping.

Held and escalated actions enter a review workflow with full context. A reviewer approves once, rejects, or turns the decision into a standing rule. Escalation can fire instantly to Slack, Teams, or webhook. Approve-and-remember means review volume falls as policy matures.

A working control plane: the deterministic three-layer engine (policy, behavioral, mission), four-decision enforcement, shadow mode, signed receipts, human review, and OTEL export — plus a hosted live demo with the real refund flow (agent proposes → Verun holds → human approves → Verun executes the refund → signed receipt). On the roadmap and not yet claimed as done: robust intent verification (today's mission layer is a deterministic off-topic tripwire), liveness / agent-health monitoring, and SOC 2 / ISO certification.

Yes — that's a core path. If you're a systems integrator or build agents for clients, Verun is the governance layer you offer on top. We're onboarding design partners alongside direct pilots.

We're onboarding our first design partners, focused on e-commerce and customer-support automation. Reach out via the contact form on the About page or at hello@verun.ai.