unauthorised actions
In every cell of every model measured.
The guarantee is measured against the record, not asserted: zero is the number of times a model got an action past the gate without a human's grant.
Any model. Work checked, not claimed.
VEGA is a control plane that sits outside the model. Every consequential action passes a gate the model cannot talk its way past, so choosing a model stops being a safety decision. Work is reconciled against what actually happened rather than taken on the agent's word, and a hash-chained record shows what was done without trusting the agent's account. Open weights on your hardware, or a provider of your choice.
Scroll to dive in
Sovereign enterprise autonomy
Your hardware or the leading providers
01 · The guarantee, in numbers
A benchmark world, not production. Every number below comes from benchmark runs, and each says which.
legitimate action refused in 240 runs
The price of the gate.
Legitimate work refused in 1 of 240 runs across three models: 0 of 120 on qwen3:8b, 0 of 60 on nemotron-3-super, 1 of 60 on llama3.1:8b, where the right tool was called with a wrong parameter name. Quoted beside the guarantee rather than hidden from it.
long-horizon work completed
The gate is not a brake.
In one synthetic benchmark scenario, an 8B model with the control plane finished the long-horizon task in 40 of 40 runs. Without it, 7 of 40 (17.5%), on the same model and the same task (p = 1.2e-15). One scenario, not a general rate.
02 · How a node comes to life
Deployed, then plugged in, then trusted a little at a time.
An identity, an accountable human, a model route.
The declaration is the one file the agent can never write: who answers for it, which hosts it may reach, which model it runs on. A node is not a folder on a PC.
It asks which services carry your organisation's life.
It proposes a source, you click approve. Credentials sit in a vault under a key it can name but never read. No connector is shipped for any vendor; your deployment authors its own.
It drafts the smallest authority for the next thing. You grant it.
A mandate names actions, scope and a duration. Autonomy widens on two axes, never both at once by default. Every human step is one click on something the agent drafted.
03 · Outside the prompt
The kernel imports no model.
Every proposed action is checked against typed preconditions, the mandate's scope and a host allowlist your organisation wrote. What persuaded the model to propose it is irrelevant to the check. A secret rides into a request by key; the model never holds the value. The record is hash-chained with no update and no delete.
Read the threat modeljournal · liveverify_chain ok
A realistic sample, not a customer's record
04 · What holds
- The gate sits outside the model. Prompt injection changes what the model proposes, never what passes.
- Every consequential action is typed: preconditions, postconditions, idempotency keys, reconciliation and recovery.
- A secret rides into a request by key. The model never holds the value, so it cannot leak one.
- Loopback by default. Every route needs a bearer token or your identity provider. Rotation locks out a running server.
- The journal has no update and no delete. Verifying it recomputes every digest and raises on any gap.
- Backups never contain the vault. Personal data is erased by destroying its key, and the chain still verifies.
05 · Your model, measured before it is trusted
Open weights on your GPUs, or the leading models from the high-end providers.
Locked to no vendor. Every model runs the same qualification battery before it is trusted with anything: seven cells, ten seeds each, two arms. The unaided arm shows what the model does on its own; the kernel arm shows what passes with VEGA in front of it.
ModelFloorUnaided, failedWith VEGA, passed
qwen3.5 · 4Bpassed6 of 7068 of 70
qwen3.5 · 9Bpassed0 of 6969 of 69
qwen3.8 · 27Bpassed0 of 7070 of 70
gemma4 · 31Bpassed0 of 7070 of 70
A pass on the floor clears a model for use; it does not rank it above its neighbour. A person reads the record before deciding what the model may be trusted for. The full catalogue, every model, every cell → · See the fleets a node can run →
06 · Three ways to run it
Self-hosted licence
Your GPUs, your network, your keys. Nothing of yours touches a server we run.
Hosted kernel, your endpoint
We run the control plane; inference stays where you put it.
Fully hosted, yearly
One node per customer, never shared.