Five minutes to a governed session.

One binary. It carries the dev kernel, so nothing else is required to get a local microVM running.

curl -fsSL velone.in/install.sh | sh

$ velone version
velone 1.4.0 (kernel 1.4.0)

Device flow against your identity provider. The token is scoped to your user and expires.

$ velone login

  open  https://velone.in/device
  code  QRTZ-4188

  ✓ signed in as mara@acme  ·  org acme  ·  ring 2 max

Start narrow. Deny egress, allow the two tools you actually need, and escalate the one that spends money.

# velone.policy.yaml
version: 1
session: quickstart
ring: 2

egress:
  default: deny
  allow: [registry.npmjs.org, github.com]

tools:
  shell.exec:
    allow: true
  files.write:
    allow: true
    paths: ["/workspace/**"]
  http.post:
    escalate: true
    approvers: [mara@acme]

The agent code is unchanged. Only the execution path is different.

$ velone run --policy velone.policy.yaml -- python agent.py

  session   session/a04f  ·  ring 2  ·  eu-central
  sandbox   microVM booted in 162ms
  policy    v1 loaded  ·  3 tools  ·  egress deny

  09:02:11  shell.exec    pip install -q requests     ALLOW
  09:02:14  files.write   /workspace/out.json         ALLOW
  09:02:15  http.post     api.internal.acme/tickets   ESCALATE
            → waiting for mara@acme
  09:02:38  http.post     api.internal.acme/tickets   ALLOW (approved)
  09:02:39  net.fetch     telemetry.vendor.io         DENY  (egress)

  session ended  ·  5 actions  ·  1 denied  ·  1 approved

The denial on the last line is the interesting one. Something in your dependency tree tried to call home.

$ velone evidence show session/a04f --decision deny

  seq 5  ·  09:02:39.117Z
  tool        net.fetch
  target      telemetry.vendor.io:443
  decision    DENY
  rule        egress.default
  caller      /workspace/.venv/lib/requests/adapters.py:487
  hash        sha256:b81f27…4c

$ velone verify --session session/a04f
  5 entries  ·  chain intact ✓  ·  approvals verified ✓