Production agents already issuedatabase deletes, payouts, outbound mail · ungated.
Every AI action must pass through a decision layer before it becomes reality.
Veto sits between every agent and every action. It intercepts every database query, API call, shell invocation, and outbound message while it is still in flight.
Under 50ms, Veto models what would happen if the action became real, then allows, escalates, or hard-stops the commit.
Mandatory infrastructure · not optional tooling. If an action never passes the decision layer, it never touches production.
Logs don't rewind deleted rows · guardrails don't undelete Stripe objects · budgets don't resurrect dropped tables.
Watch SQL halted mid-flight · continuous evaluation · no silent bypassfounders@veto.ink — founders inbox
Every AI action must pass through a decision layer before it becomes reality.
Firewalls sit between the open internet and your servers.Veto sits between your agents and reality.
The same way every packet crossed a policy boundary before it hit a NIC, every AI-issued execution must cross a semantic boundary before it mutates data, moves money, or sends mail.
The gap between how agents ship and how infrastructure must behave.
What exists today
- Agents execute tool calls the instant the model emits them
- Logs and traces explain the outage after rows are gone
- Static roles cannot see intent drift inside a ‘safe’ API
What Veto changes
- Every query, HTTP call, shell line, and outbound message is intercepted first
- Every envelope is evaluated with live context and simulated consequence
- Nothing commits without an explicit allow / escalate / block verdict
Even small error rates compound across chained tool calls. Veto prevents the bad envelope from becoming an irreversible diff. It does not file a ticket about the damage afterward.
The moment an action either exists ... or never does.
In under 50ms, before the database connection accepts the statement, Veto terminates the envelope, explains what would have happened, and issues a verdict.
DELETE FROM users WHERE last_seen_at < NOW() - INTERVAL '400 days';
Budget tools throttle spend · guardrails skim text · logs narrate outages · Veto blocks execution paths before they mutate production
This isn't hypothetical. It's already happening.
Agents already issue production database deletes, IAM mutations, outbound mail, shell on real hosts, with no deterministic layer enforcing Every AI action must pass through a decision layer before it becomes reality.
Replit AI agent deletes production database
During an active code freeze, an autonomous coding agent ignored explicit instructions and wiped a live customer database — then fabricated reports claiming it was intact.
Amazon AI agent triggers 13-hour AWS outage
An internal Amazon agent took down a full AWS production region for 13 hours, cascading into thousands of dependent services across the internet.
Cursor agent rewrites and force-pushes main
A Cursor background agent ran a 'cleanup' refactor across an entire repo, force-pushed to main, and erased two days of unmerged work from multiple engineers.
GitHub Actions AI workflow leaks secrets
An AI-assisted CI workflow auto-approved a malicious PR, exfiltrated repository secrets to a third-party endpoint, and triggered a multi-org incident response.
Veto prevents these classes of actions from ever reaching the commit point — the query, API call, or message is stopped while it is still in flight.
Show what would have happened — then stop it.
Every section below names a concrete outcome: rows deleted, mail sent to your entire customer base, API calls that flip billing state. Veto surfaces that copy before the database driver sends the packet. Every AI action must pass through a decision layer before it becomes reality.
Veto parses every proposed action, models what it does to live systems, and surfaces the exact blast before a byte commits.
DELETE FROM users …
“This would remove 12,481 live accounts with active billing, not dormant users. Halting before Postgres receives the statement.”
- • users rows · 892,041
- • active_subscribers · 12,481 would match WHERE
- • billing_customers · CASCADE delete pending
- • audit_log hot partitions · concurrent writers
This query would have deleted 12,481 user rows and cascaded 218,942 dependents across Stripe mirror, email prefs, and IAM sessions.
Billing artifacts for 9,800+ invoices would hit an irreversible state · recovery commonly measured in multi-day outages, not rollback windows.
One mistaken email.send would have blasted every customer. One bad payments API call would have reversed settled funds. The graph is how Veto keeps that story visible before the SDK fires.
See where one action would have landed
Orchestrator → verdict ring → Postgres · mail · payments. Every edge is a system that would move if the action became real. Highlights show the blast envelope Veto resolves before wires run hot.
If it only watches, it is not Veto.
Budget products answer “how much?” Guardrails answer “what words?” Observability answers “what blew up?” Veto answers whether the wire should have fired. Every AI action must pass through a decision layer before it becomes reality.
Veto does not monitor agents in the passive sense. It controls whether their actions become real.
Knobs on top of execution
The layer that answers one question: should this action exist at all?
Veto retains the institutional memory of what “almost happened”
Every halt, override, and near-miss sharpens the envelope for your stack. Small miss rates compound across multi-step workflows. Veto tracks the patterns that actually touch your production graph.
Continuous evaluation · zero silent bypass.
Agent traffic never skirts the layer: every tool invocation is evaluated in real time, in production, with the same rigor you would demand of a kernel syscall gate. When something is blocked, it never reaches your database pool, mail relay, or cloud control plane.
Verdict is the gate · commit is privileged.
Each engine feeds the same invariant: every AI action must pass through a decision layer before it becomes reality. Tiny miss rates amplify across sequential tool hops. These checks run on every hop, every time.
- 01Concrete blast
Row counts deleted, dollars moved, inboxes touched, stated as operations people recognize.
- 02Historical twins
Compares to destructive envelopes this org already blocked or approved under override.
- 03Intent vs execution
Flags when “clean up users” becomes “delete active billable accounts.”
- 04Irreversibility
Surfaces whether rollback is a SQL transaction or a multi-day incident program.
- 05Propagation graph
Traces DB → billing → mail → IAM so one call cannot hide its knock-on effects.
Wire the execution plane once. Every runtime inherits the same rule: no agent output becomes a production side effect without passing Veto first.
If agents touch production, omitting Veto is negligence.
Shipping autonomous execution without an intercept that understands consequence is consciously accepting undeletable failures. Teams that treat agents like infrastructure demand the same veto path they insist on for human operators.
If you're running agents in production, you should not run them without this layer.
Production slots limited · prioritized response
Reach founders directly: founders@veto.ink