# Veefore

> Veefore is the control layer between AI agents and the systems they touch. Every agent gets its own identity and narrow, provable authority. Every action it takes is decided by versioned policy at a gateway outside the agent, risky actions wait for a human approval bound to that one request, and every decision lands in a hash-chained audit trail.

Veefore is not an agent framework and not a model. Teams keep their models, frameworks and prompts (OpenAI, Anthropic, LangGraph, CrewAI, the Vercel AI SDK or their own code) and wrap consequential actions in one SDK call. Enforcement lives in the gateway and tool credentials are held by a broker, so an agent that skips the SDK, or is jailbroken, reaches the tool with no credential. The model is not the security boundary; Veefore is.

Status: private beta. Request access at https://console.veefore.com/waitlist. Customers sign in at https://console.veefore.com.

## What it does

- **Agent identity:** every agent holds its own Ed25519 key and signs every request. No shared API tokens; one agent can be revoked without touching the rest.
- **Bounded authority:** capabilities say what an agent is for, and delegations narrow it further. A child grant can never exceed its parent; attempts are refused, not silently clamped.
- **Policy on every action:** versioned, testable rules evaluate identity, context and risk on each request. Every decision names the rule that produced it.
- **Human approvals:** an approval is bound to one specific request (this agent, this tool, these parameters). Approving a $240 refund does not approve the next one.
- **Credential broker:** the agent never holds the secret. Veefore leases a short-lived, scoped credential to the tool runtime only after a request is allowed.
- **Audit:** intent, decision, approval, credential lease and result are hash-chained, so a missing or edited event breaks the chain. Exports are watermarked and audited.
- **Risk:** velocity, amount, destination and behaviour signals raise the bar automatically.
- **Kill switch:** isolate one agent, one tool or a whole environment in a single action.
- **MCP and A2A:** register Model Context Protocol servers and agent-to-agent peers once; every call goes through the same identity, policy, approval and audit pipeline.
- **Safe rollout:** every environment starts in Observe (records what policy would decide, blocks nothing), then Simulate (full pipeline, no side effects), then Enforce.
- **Developers:** TypeScript and Python SDKs, a CLI, and policy tests that run in CI.
- **Deployment:** the gateway and control plane ship as containers with Kubernetes manifests and can be self-hosted. Secrets can stay in HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GCP Secret Manager. Workforce sign-in supports OIDC and SAML SSO, SCIM provisioning, passkeys and TOTP.
- **Latency targets:** policy evaluation under 10 ms at p50 and authentication under 25 ms at p95, excluding time spent in the tool itself.

## Documentation

The full documentation is at https://docs.veefore.com. It has its own index for AI assistants at https://docs.veefore.com/llms.txt, and every page in one file at https://docs.veefore.com/llms-full.txt.

- [Documentation home](https://docs.veefore.com/_llms/index.md): what Veefore is and where to start
- [Quickstart](https://docs.veefore.com/_llms/quickstart.md): from an existing agent project to real, server-side decisions on its tool calls, in one command
- [How it works](https://docs.veefore.com/_llms/how-it-works.md): the stages a protected action passes through, what each can refuse, and what gets recorded
- [What Veefore is not](https://docs.veefore.com/_llms/scope.md): the deliberate exclusions
- [Enforcement modes](https://docs.veefore.com/_llms/concepts/enforcement-modes.md): Observe, Simulate and Enforce
- [Policy](https://docs.veefore.com/_llms/concepts/policy.md): deterministic, versioned rules and their precedence
- [Approvals](https://docs.veefore.com/_llms/concepts/approvals.md): human decisions bound to one request
- [Credential broker](https://docs.veefore.com/_llms/concepts/credentials.md): short-lived, scoped credentials the agent never holds
- [Audit](https://docs.veefore.com/_llms/concepts/audit.md): hash-chained events and verifiable exports
- [TypeScript SDK](https://docs.veefore.com/_llms/build/javascript-sdk.md): the @veefore/sdk surface
- [Python SDK](https://docs.veefore.com/_llms/build/python-sdk.md): the veefore-py surface
- [MCP](https://docs.veefore.com/_llms/build/mcp.md): governing Model Context Protocol servers
- [A2A](https://docs.veefore.com/_llms/build/a2a.md): verified connections to agents you do not own
- [Self-host Veefore](https://docs.veefore.com/_llms/install.md): run it on your own infrastructure
- [Threat model](https://docs.veefore.com/_llms/secure/threat-model.md): attacker goals and the mechanism that refuses each one
- [FAQ](https://docs.veefore.com/_llms/faq.md): common questions, answered directly

## Optional

- [Glossary](https://docs.veefore.com/_llms/glossary.md): every term Veefore uses with a specific meaning
- [CLI reference](https://docs.veefore.com/_llms/reference/cli.md): every `veefore` command
- [Policy fields](https://docs.veefore.com/_llms/reference/policy-fields.md): every field a policy rule can test