Platform · 03 · policy

The model proposes. Velone decides.

Policy runs outside the model, before the call, in code you can read. An agent cannot talk its way past it, and a prompt injection cannot rewrite it.

policy surfacefile on the left, decisions on the right

IMG 03velone-policy-surface.pngPolicy page hero

01 / the mistake

Guardrails in the prompt are not controls.

“Never delete production data” in a system prompt is a preference. It shares a channel with the attacker’s text, it degrades as context fills, and it cannot be audited. When it fails, nothing stopped the call — the model simply chose differently that time.

A control is external, deterministic, and in force whether or not the model cooperates. Velone evaluates every tool call against policy the agent cannot see, cannot edit, and cannot skip.

prompt

A request

Same channel as the attack. Degrades with context. Unauditable.

policy

A decision

Out of band. Deterministic. Recorded with a reason every time.

02 / the file

Policy is a file in your repository.

Version it, review it, diff it, require two approvals to change it. The kernel enforces whatever is committed.

# velone.policy.yaml
version: 3
session: claims-bot
ring: 2

egress:
  default: deny
  allow:
    - api.stripe.com
    - github.com
    - registry.npmjs.org

tools:
  shell.exec:
    allow: true
    deny_args: ["rm -rf /", "curl * | sh", ":(){ :|:& };:"]
  files.write:
    allow: true
    paths: ["/workspace/**"]
  stripe.refund:
    escalate: true            # ring 1 — a human signs
    approvers: ["mara@acme", "finance-oncall"]
    max_amount_usd: 5000
  email.send:
    escalate: true
    approvers: ["mara@acme"]
  db.query:
    allow: true
    deny_args: ["DROP", "TRUNCATE", "DELETE FROM"]

budget:
  wall_clock: 4h
  spend_usd: 25
  tool_calls: 2000

03 / how a call is decided

1
Identify
Which session, which principal, on whose behalf, at which ring.
2
Match
Tool name and arguments against the committed policy version.
3
Decide
Allow, deny, or escalate — with the matching rule attached as the reason.
4
Record
Append the decision to the evidence chain before the call is allowed to run.

04 / what you can constrain

Tools: Per tool, per method, and per argument pattern. Deny by default and allowlist, or allow and denylist the sharp edges.
Egress: Hostnames, ports, and protocols, resolved at the proxy. A denied host never receives a packet, so an exfiltration attempt fails closed.
Data: Which paths, buckets, tables, and columns a session may read or write. Column-level denies for regulated fields.
Money: Hard ceilings on spend per session and per action, plus named approvers above a threshold.
Time: Wall-clock and business-hours windows. An agent can be barred from acting at 3am on a Sunday.
Blast radius: Row counts, file counts, and recipient counts. A bulk operation crosses a different line than a single one.
Approval: Escalations route to Slack, email, or your own endpoint, and resolve to a signed token bound to a named human.

05 / questions

Does a policy check slow the agent down?

Evaluation is single-digit milliseconds and runs in-process next to the sandbox. Against tool calls that take hundreds of milliseconds at best, it does not register. Escalations obviously take as long as the human does.

Can agents request a policy change?

They can request one; they cannot grant it. A request becomes a pull request against the policy file, which a human merges. The agent's own privilege can never widen its own constraints.

What happens on a deny?

The call fails with a structured error naming the rule. The agent sees the denial and can try a different approach, which is usually the right outcome — it learns the boundary instead of silently failing.

Can we write policy in code instead of YAML?

Yes. The YAML compiles to the same decision API, and you can implement that API directly in TypeScript, Python, or Go if you need dynamic logic or an existing authorisation service.

Does this replace our IAM?

No — it consumes it. Principals map to your identity provider, and approvers are your real directory users. Velone governs what agents do with the access you already model.

keep reading

EvidenceWhere every decision is written down.GatewayThe proxy that enforces egress and mints tokens.Financial operationsPolicy applied to money movement.

Ring 0

Write the boundary down once.

Bring the three actions that would end a bad week for you. We will put them behind a gate you can prove is in force.

Request access