01 · session
Identity that survives the machine
An agent keeps one durable name across crash, sleep, model swap, and host swap. The session is not the context window.
Agent hypervisor · ring 0
The kernel agents run inside.
Keep the model. Keep the harness. Velone is the boundary every shell, file, browser, and MCP call has to cross first — identity, isolation, policy, evidence.
Not a framework · not a sandbox SaaS · runs in your VPC
velone runtimelive session · policy decisions as they happen
- on behalf of
- user:mara@acme
- model
- swapped 2× · state kept
- secrets
- 0 standing
- uptime
- 6h 12m
timecallargumentringdecision
- 09:14:02shell.execpytest -q tests/R2allow
- 09:14:06files.read/workspace/claims.pyR2allow
- 09:14:11net.fetchapi.unknown-host.ioR3deny
- 09:14:19mcp.callgithub.create_issueR2allow
- 09:14:27stripe.refundamount=48200 cur=usdR1escalate
- 09:14:31files.write/workspace/patch.diffR2allow
79%
have adopted agents
2%
reached production scale
5
vendors doing this today
plus a pile of YAML
1
boundary you can prove
01 / the gap
Models are good enough. Frameworks are a commodity. What is still not for sale is the boundary an enterprise will actually turn on.
Every team shipping agents into production rebuilds the same five things: a sandbox, an identity story, an egress rule, an approval step, and an audit trail. Today that is four vendors and a repo of config, and it is the reason pilots never graduate.
Velone ships those five as one enforced path. Your agent does not change how it thinks. It changes where it executes.
Read the thesis02 / four primitives
Sold separately, this market stays broken.
Isolation without a decision log is half of production. A policy engine without a sandbox is a suggestion. Velone binds all four into a single execution boundary.
02 · sandbox
A computer with no standing secrets
Hardware-isolated execution for untrusted code. Credentials stay in the control plane; the box gets a scoped, short-lived token or nothing at all.
03 · policy
The model proposes. Velone decides.
Allow, deny, or escalate evaluated before the tool runs. Deterministic gates, not an instruction in the prompt and a hope.
04 · evidence
A record you can hand a CISO
Which agent, on whose behalf, which tool, what arguments, what result, who approved. Hash-chained and exportable, not a screenshot of logs.
03 / where it sits
Under the harness, not in front of it.
Velone is not another place to write an agent. It sits between the loop you already run and the world it wants to touch. The harness keeps planning; execution moves through a governed ring.
One integration covers every tool the agent has — shell, files, HTTP, browser, MCP servers, and your internal APIs.
curl -fsSL velone.in/install.sh | sh
execution pathharness → kernel → world
04 / how it works
Four moves to a governed agent.
- 1
Wrap tool execution
One SDK call around the place your agent already runs tools.
- 2
Declare the boundary
A policy file: which tools, which hosts, which actions need a human.
- 3
Point it at a ring
Managed microVMs, your own cloud account, or your own metal.
- 4
Keep the evidence
Every decision chains into a record you can replay and export.
05 / what it replaces
1 contract
velone, per year
One boundary, one audit surface, one integration. Sessions, sandboxes, policy, and evidence arrive together.
4 vendors
the stack you have now
A sandbox API, a gateway, a secrets manager, an observability bill — and the glue code nobody wants to own.
06 / keeps your stack
Model-agnostic on purpose.
Locking to one model is a feature, not a company. Swap Claude for GPT tomorrow and the session, the policy, and the audit trail stay exactly where they were.
- Claude Agent SDK
- OpenAI Agents SDK
- LangGraph
- CrewAI
- Google ADK
- Microsoft Agent Framework
- Codex CLI
- Your own loop
07 / still open
The honest answers.
Is this a framework?
No. Keep LangGraph, the Claude Agent SDK, Codex, CrewAI, or the loop you wrote yourself. Velone is the kernel those loops execute through, and it never asks to own the planning.
How is this not another sandbox?
A sandbox is a computer. Velone binds that computer to an identity, a policy gate, and an evidence chain. If you only need a place to run Python, buy a sandbox — it is cheaper and we will happily sit on top of one.
Will you be replaced by AWS AgentCore?
If you are all-in on one cloud and one model family, use theirs. Velone is for teams that mix models, mix clouds, and need the boundary inside their own perimeter. Full comparison.
Does it run in our environment?
Yes. Managed cloud to start, then bring-your-own-cloud in your AWS, GCP, or Azure account, and an air-gapped build for regulated estates. Data and secrets never have to leave your perimeter.
What does it cost us in latency?
A policy decision is evaluated in single-digit milliseconds locally. Sandbox cold start is budgeted under 200ms on warm pools. The numbers and how we measure them are on the infrastructure page.
Ring 0
Ready to put a kernel under the agent?
If your agents already touch code, money, or customer systems, they should be running inside a boundary you can prove. Any model, any harness, your cloud.