Platform
One boundary, four primitives.
Velone is not a place to write agents. It is the ring they execute inside — the single path every shell command, file write, HTTP call, browser action, and MCP request has to take.
01 / the premise
Sold separately, these four are why agents stay stuck in pilot.
A sandbox vendor gives you isolation with no idea who is asking. A gateway gives you policy with no idea what is executing. A secrets manager hands out credentials and hopes. An observability tool tells you afterwards.
Velone assumes the four are one problem. The identity of the caller decides what the policy allows, the policy decides what the sandbox receives, and the sandbox reports into the same evidence chain that authorised it.
01 / Sessions
Identity that survives the machine
A durable name for an agent, independent of the process running it. Pause, resume, migrate hosts, swap models — the session and everything attached to it persists.
- Parent and child delegation chains
- Pause and resume with full filesystem state
- Survives crash, sleep, and model swap
02 / Sandboxes
A computer with no standing secrets
Hardware-level isolation for untrusted code. Every sandbox starts with nothing: no credentials, no network, no shared kernel with another tenant.
- Firecracker microVMs, not shared-kernel containers
- Default-deny egress with per-session allowlists
- Snapshot and fork a running box
03 / Policy
The model proposes. Velone decides.
A deterministic gate in front of every tool call. Policy is evaluated before execution, not summarised after it, and it never lives in the prompt.
- Allow, deny, or escalate per tool and argument
- Human approval on irreversible actions
- Budgets for tokens, spend, time, and blast radius
04 / Evidence
A record you can hand a CISO
Every decision and every action appends to a hash-chained log. Six months later you can prove what an agent did, under whose authority, and who approved it.
- Tamper-evident chain with verifiable digests
- Replay any session step by step
- Export to SIEM, S3, or your warehouse
05 / the ring model
Privilege is a ring, not a checkbox.
Every session runs at a ring. The ring decides what the policy engine will even consider, so a demotion is a hard constraint rather than a prompt instruction.
- Ring 0
- The kernel itself. Velone control plane, policy evaluation, evidence writer. No agent code ever runs here.
- Ring 1
- Human-gated actions. Payments, production deploys, outbound email, destructive data operations. Requires an approval token bound to a named person.
- Ring 2
- Normal agent work. Shell, files, allowlisted hosts, approved MCP servers. The default for a session doing real tasks.
- Ring 3
- Untrusted and exploratory. No network, no secrets, scratch filesystem only. Where a fresh agent starts until it earns more.
Ring 0
Put the kernel under the agent you already have.
Bring your harness and your model. We will show you the boundary running against a real workload in under a week.