How It Works

The agent proposes. Verun authorizes.

Every consequential action passes three layers of control before it executes. Deterministic. Explainable. No LLM judge in the decision path. Runs inline with negligible overhead.

The action enters the gateway

Agent proposes an action

The agent runtime routes the consequential action through Verun — via the OpenAI-compatible proxy, the sidecar, or an explicit SDK call.

Via proxy, the agent thinks it is talking to its model provider. Verun intercepts the tool-call transparently, before it reaches any tool or API.

Deterministic controls

Policy — Can it?

The action is checked against tenant policy: allowed tools, thresholds, environment restrictions, allow/block lists, and mandatory-approval rules. Default-deny — undefined actions don't proceed.

Policy is JSON-configured per tenant and hot-reloads without restart. No LLM, no probabilistic scoring.

Behavioral controls

Behavior — Does it usually?

The action is scored against the agent's own behavioral baseline. Velocity bursts, first-seen targets, cross-domain behavior, and unusual sequences raise an anomaly signal — UEBA for agents.

The baseline is per-agent and compounds over time — sharpening with every decision and human ruling. Anomalies hold; they never silently block.

Mandate controls

Mission — Should it?

A deterministic off-topic tripwire: an action drifting from the agent's declared purpose is held for human review before it executes.

This is a topic-level tripwire, not full intent verification — robust intent verification is on our roadmap. As with every layer, there's no LLM on the decision path.

ALLOW / HOLD / BLOCK / ESCALATE

Decision returned

Verun returns one of four decisions synchronously. ALLOW proceeds. HOLD pauses for review. BLOCK refuses. ESCALATE pushes to a human immediately. Behavioral and mission signals hold — they never silently block.

Decisions are deterministic: the same input always yields the same decision and the same stated reason. A false positive costs one human review, not a broken workflow.

Roll out without breaking anything

Enforcement mode applied

Tenants graduate through enforcement phases: observe (record what would have happened), hold_only (convert blocks to holds), then full. No team deploys blocking infrastructure cold.

In observe mode the computed decision is recorded on the receipt as a simulated decision — you see exactly what Verun would have done before it does anything.

Operational software, not a Slack ping

Human review, when needed

Held and escalated actions enter a review workflow with full context — proposed action, target, reason, anomalies, policy version. A reviewer approves once, or turns the decision into a standing rule.

Escalation can fire instantly to Slack, Teams, or webhook. Approve-and-remember means review volume falls as policy matures.

Tamper-evident, replayable evidence

Signed receipt written

Every decision produces a signed receipt: which layer decided, why, under which policy version, with the anomaly and mission signals attached. Replayable as evidence.

Receipts export as Governance Evidence Packs (JSON/PDF) for audit and compliance, and emit OpenTelemetry spans to Datadog, Grafana, Splunk, or any OTLP backend.

The loop's final step

From observation to policy.

After observing, Verun mines the recorded decisions into a draft policy — an allowlist of the actions your agents actually use, sensible thresholds from what it saw (for example, a refund-amount threshold for the refund action), and default-deny for everything else. Deterministic, explainable, and yours to approve — no LLM, no blank page.

Connectivity

Govern any agent, any stack.

From a single HTTP call to a drop-in proxy to an MCP gateway. Choose the level of enforcement your deployment needs.

Primary

Proxy

Agent thinks it is talking to its model provider. Verun intercepts each tool-call, authorizes it, then forwards (ALLOW), pauses (HOLD), refuses (BLOCK), or routes to a human (ESCALATE). Zero application code changes.

env

OPENAI_BASE_URL=https://verun-proxy.internal

Kubernetes

Sidecar

No base-URL change required. Intercepts outbound HTTP at the network layer via sidecar injection. Envoy/Istio ext_authz compatible. Configured via Kubernetes annotations and a Helm chart.

The right choice for teams that cannot route all traffic through a single proxy, or who require network-layer enforcement independent of application code.

Helm chartext_authzZero app changes

Optional

SDK

For teams that want explicit instrumentation and per-action control. Zero required dependencies — Python stdlib only.

Python

d = verun.authorize(
  agent_id=...,
  action=...
)
if d.held:
  verun.wait_for_review(d.receipt_id)

Protocol layer

MCP gateway

Govern tool-calls at the Model Context Protocol layer. Every tool an MCP client invokes is authorized before it runs — no per-agent wiring.

No-code

n8n · Make · Zapier

Drop a Verun node into a no-code workflow. Automations built by ops teams get the same authorize → hold → approve path as coded agents.

Lowest friction

One-line HTTP call

Any agent or chatbot can self-check by calling one Verun endpoint from its own instructions. Near-zero setup — see “Verun in one line” below.

Verun Light · low-friction on-ramp

Verun in one line.

Any agent or chatbot can govern itself by calling a single Verun HTTP endpoint from its own prompt or instructions — before it takes a consequential action, it asks Verun and obeys the decision. Near-zero setup, works anywhere.

Honest trade-off:this path is opt-in and cooperative — the agent has to choose to call it, so it can be bypassed. It's great for governing your own agents, not for adversarial enforcement. When you need enforcement that can't be skipped, upgrade to the SDK, proxy, sidecar, or MCP gateway.

Verun Light is currently in testing with a small closed community.

agent-instructions.txt

# In your agent's system prompt:
Before any refund, payment, or email,
POST the action to
  https://api.verun.ai/authorize
and only proceed if it returns allow.
If hold, tell the user it's pending review.

Python SDK

One call before every consequential action.

The SDK is zero-dependency — Python stdlib only. Drop it into any environment. Every call returns a deterministic decision and a signed receipt.

✓Works with LangGraph, CrewAI, AutoGen, and raw Python
✓Synchronous — decision returned in the same call
✓Four decisions: allow / hold / block / escalate
✓Signed receipt stored automatically

verun_integration.py

import verun

# Authorize before a consequential action
decision = verun.authorize(
    agent_id="support-refund-agent",
    action={
        "type": "issue_refund",
        "amount": 4200,
    }
)

# Handle the decision
if decision.allow:
    issue_refund()
elif decision.held or decision.escalated:
    queue_for_review(decision.receipt_id)
else:  # blocked
    log_blocked(decision.reason)

Human-in-the-Loop

When Verun says Hold or Escalate.

A hold doesn't cancel the workflow. It queues the action for human review with full context, pausing execution until someone decides — or until a standing rule decides for them.

Hold / Escalate

Verun pauses the action. Receipt stored with the reason and signals.

→

Review Queued

Reviewer sees the action, target, anomaly signals, and policy version.

→

Decide or Remember

Approve once, reject, or turn the decision into a standing rule.

→

Agent Resumes

If approved, the agent continues — decision logged. If rejected, the workflow ends cleanly.

Inline

Negligible overhead

Synchronous and deterministic

LLMs on the decision path

Same input → same decision → same reason

100%

Decision coverage

Every action produces a signed receipt

See the architecture behind the layer.

View Architecture →Request a Pilot