# Veefore > Identity, authority, policy and enforcement for autonomous AI agents. This is the documentation for Veefore, published at https://docs.veefore.com. The product site is https://veefore.com. Every page is also available as Markdown at `https://docs.veefore.com/_llms/.md`, and the whole site is one file at https://docs.veefore.com/llms-full.txt. ## Home ### Get started - [Veefore documentation](https://docs.veefore.com/_llms/index.md): Identity, authority, policy and enforcement for autonomous AI agents. Give an agent real power without giving it unlimited power. - [Quickstart](https://docs.veefore.com/_llms/quickstart.md): From an existing agent project to real, server-side decisions on its tool calls, in one command. - [How it works](https://docs.veefore.com/_llms/how-it-works.md): The twelve stages a protected action passes through, what each one can refuse, and what gets recorded. - [Self-host Veefore](https://docs.veefore.com/_llms/install.md): Run the control plane, the gateway and the console on your own infrastructure, against your own PostgreSQL. - [What Veefore is not](https://docs.veefore.com/_llms/scope.md): The deliberate exclusions, why each one is excluded, and the build gate that keeps them out. ### Your journey - [1. Start in OBSERVE](https://docs.veefore.com/_llms/journey/observe.md): Learn what your agent actually does before you decide what it should be allowed to do. - [2. Prove it in SIMULATE](https://docs.veefore.com/_llms/journey/simulate.md): Real refusals, zero side effects. The mode where a wrong policy costs you a wrong line in a report. - [3. Turn on ENFORCE](https://docs.veefore.com/_llms/journey/enforce.md): The promotion itself — preflight, replay, confirmation, step-up — and how to make the first one small enough to be boring. - [4. Operate it](https://docs.veefore.com/_llms/journey/operate.md): What day two looks like — the rhythms, the reviews and the things that rot if nobody owns them. ### Core concepts - [Agent identity](https://docs.veefore.com/_llms/concepts/identity.md): Every agent holds its own Ed25519 key pair, proves possession on every request, and can be revoked terminally. - [Agent Passport](https://docs.veefore.com/_llms/concepts/passport.md): A signed, verifiable, portable statement of who an agent is and what it may do — and why it is never the authorization decision. - [Capabilities](https://docs.veefore.com/_llms/concepts/capabilities.md): The static grant that says what an agent exists to do, and why it is separate from the tool registry. - [Delegated authority](https://docs.veefore.com/_llms/concepts/delegation.md): Bounded, time-limited, revocable grants that can never exceed their parent — the one invariant the whole model rests on. - [Policy](https://docs.veefore.com/_llms/concepts/policy.md): Deterministic, total, versioned rules over a closed field set — and the exact precedence that decides when several of them match. - [Enforcement modes](https://docs.veefore.com/_llms/concepts/enforcement-modes.md): OBSERVE, SIMULATE and ENFORCE — what each one actually does, and the one thing about OBSERVE that surprises everyone. - [Risk engine](https://docs.veefore.com/_llms/concepts/risk.md): Thirteen named signals, weighted into an explainable score that policy can test — with no model you cannot interrogate. - [Approvals](https://docs.veefore.com/_llms/concepts/approvals.md): A human decision bound to one specific request, with quorum, escalation and expiry — never a standing permission. - [Credential broker](https://docs.veefore.com/_llms/concepts/credentials.md): The agent never holds the secret. Veefore seals material on the way in and leases short-lived, scoped credentials on the way out. - [Trust evidence](https://docs.veefore.com/_llms/concepts/trust.md): Expiring, typed evidence that policy can require — not a reputation score. - [Audit](https://docs.veefore.com/_llms/concepts/audit.md): Hash-chained events, watermarked exports, and an integrity check that tells you exactly where a chain breaks. - [Tenancy](https://docs.veefore.com/_llms/concepts/tenancy.md): Organization, workspace, environment — the hierarchy every other resource hangs off, and the isolation guarantee behind it. ### Help - [FAQ](https://docs.veefore.com/_llms/faq.md): The questions that come up repeatedly, answered without hedging. - [Glossary](https://docs.veefore.com/_llms/glossary.md): Every term Veefore uses with a specific meaning, defined once. - [Getting help](https://docs.veefore.com/_llms/support.md): What to gather before asking, where the answer probably already is, and how to report a security issue. ## Build ### Start building - [Build with Veefore](https://docs.veefore.com/_llms/build/index.md): Everything you need to protect an agent, wire up its tools, and ship it behind enforcement. - [Automatic setup](https://docs.veefore.com/_llms/build/automatic-setup.md): What `veefore` finds in your project, what it creates, how it changes your code, and how to do any part of it by hand instead. - [Protect an agent](https://docs.veefore.com/_llms/build/protect-an-agent.md): The complete integration — configuration, handshake, decisions, refusals and approvals — in TypeScript and Python. - [Write your first policy](https://docs.veefore.com/_llms/build/first-policy.md): A real refund policy, built one rule at a time, with the reasoning behind each rule and the tests that keep it honest. - [Local development](https://docs.veefore.com/_llms/build/local-development.md): A fast loop with real decisions — simulated execution by default, a real downstream when you want one. ### SDKs - [TypeScript SDK](https://docs.veefore.com/_llms/build/javascript-sdk.md): The complete @veefore/sdk surface — protect, the client, typed errors and the assertion helpers. - [Python SDK](https://docs.veefore.com/_llms/build/python-sdk.md): The complete veefore-py surface — guard, protect, the client, dataclasses and typed exceptions. - [Sign your own assertion](https://docs.veefore.com/_llms/build/sign-your-own-assertion.md): The gateway wire protocol in full. Everything you need to authenticate an agent from any language that can sign Ed25519. ### Wire it up - [Register a tool](https://docs.veefore.com/_llms/build/register-a-tool.md): Make your system something an agent can be authorized for — with its own destination allowlist, risk rating and egress guards. - [Broker a credential](https://docs.veefore.com/_llms/build/broker-a-credential.md): Take the secret out of the agent entirely — including the material-key mistake that fails two layers from its cause. - [Delegate authority](https://docs.veefore.com/_llms/build/delegate-authority.md): Give a sub-agent a bounded slice of what the parent holds, and nothing more. - [Handle approvals](https://docs.veefore.com/_llms/build/handle-approvals.md): Three integration patterns for waiting on a human, and how to resume work that was suspended for twenty minutes. - [MCP](https://docs.veefore.com/_llms/build/mcp.md): Register Model Context Protocol servers, authorize discovered tools one at a time, and invoke them through the gateway. - [A2A](https://docs.veefore.com/_llms/build/a2a.md): Verified connections to agents you do not own — passport verification, policy on both sides, and immediate blocking. ### Integrate - [API keys](https://docs.veefore.com/_llms/build/api-keys.md): Programmatic access for your own services and CI — scoped to a role, optionally to a workspace, and shown exactly once. - [Webhooks](https://docs.veefore.com/_llms/build/webhooks.md): Signed event delivery, the exact verification you must implement, and why a webhook is never an authorization. - [Errors and retries](https://docs.veefore.com/_llms/build/errors-and-retries.md): Which refusals you handle, which you surface, and which you must never retry. - [Idempotency](https://docs.veefore.com/_llms/build/idempotency.md): Make a retry safe. Send a key, derive it from the operation, and understand what Veefore guarantees versus what your downstream must. - [Gate your pipeline](https://docs.veefore.com/_llms/build/ci-gate.md): Make a policy regression or a posture finding fail the build, with no interactive prompts. ### Examples - [Examples](https://docs.veefore.com/_llms/build/examples.md): Four working programs in examples/ — a real downstream service, a provisioning script, an agent driver, and an annotated SDK walkthrough. ## Operate ### Run Veefore - [Operate Veefore](https://docs.veefore.com/_llms/operate/index.md): Running it, watching it, and knowing what to do when something is wrong. - [Run the stack](https://docs.veefore.com/_llms/operate/run-the-stack.md): Three processes, what each is responsible for, how to check they are healthy, and how to scale them independently. - [Configuration](https://docs.veefore.com/_llms/operate/configuration.md): The settings that matter, the ones that will bite you, and the four keys you must not lose. - [Database](https://docs.veefore.com/_llms/operate/database.md): Migrations, connection pooling, row-level security, backups, and what to restore when. - [Deployment](https://docs.veefore.com/_llms/operate/deployment.md): Containers, Kubernetes, Helm and Terraform — plus the network topology that makes the plane split worth having. - [Observability](https://docs.veefore.com/_llms/operate/observability.md): Every metric Veefore exports, the traces, the log shape, and the six alerts worth having. ### Day two - [Console tour](https://docs.veefore.com/_llms/operate/console-tour.md): Every page in the console and the question it answers. - [Approvals queue](https://docs.veefore.com/_llms/operate/approvals-queue.md): Give it an owner, measure the response time, and understand why an expired approval is worse than a denied one. - [Risk Center](https://docs.veefore.com/_llms/operate/risk-center.md): Read the distribution, tune from evidence rather than intuition, and understand why raising a threshold is a security change. - [Incidents](https://docs.veefore.com/_llms/operate/incidents.md): Record an investigation, link the evidence, and let policy react to an open incident automatically. - [Emergency controls](https://docs.veefore.com/_llms/operate/emergency-controls.md): Seven controls, each with a side-effect-free blast radius preview — and the one thing you must not do instead. - [Audit and export](https://docs.veefore.com/_llms/operate/audit-and-export.md): Verify the chain on a schedule, produce a verifiable evidence pack, and treat retention changes as the destructive operation they are. ### Runbooks - [Runbook: compromised agent](https://docs.veefore.com/_llms/operate/runbook-compromised-agent.md): Contain first, investigate second, revoke only when you are sure — because revocation is terminal. - [Runbook: policy rollback](https://docs.veefore.com/_llms/operate/runbook-policy-rollback.md): A policy activation broke things. Revert narrowly, not by dropping enforcement. - [Runbook: credential leak](https://docs.veefore.com/_llms/operate/runbook-credential-leak.md): Rotate or revoke, work out what the leases could reach, and understand why the exposure is bounded. - [Runbook: dependency outage](https://docs.veefore.com/_llms/operate/runbook-dependency-outage.md): Protected actions are being refused. That is the design. Here is how to confirm it and restore service. - [Upgrades](https://docs.veefore.com/_llms/operate/upgrades.md): Forward-only migrations, the rollout order, and what cannot be rolled back. - [Troubleshooting](https://docs.veefore.com/_llms/operate/troubleshooting.md): From a symptom to a cause. The failures people actually hit, including several that look like bugs and are not. ## Security ### The security model - [The security model](https://docs.veefore.com/_llms/secure/index.md): What Veefore guarantees, what it does not, and where each guarantee is enforced. - [The boundary](https://docs.veefore.com/_llms/secure/boundary.md): Where authorization actually happens, and the four things that are frequently mistaken for it. - [Fail closed](https://docs.veefore.com/_llms/secure/fail-closed.md): When Veefore cannot evaluate, it refuses. There is no flag that changes this, and that is the point. - [Threat model](https://docs.veefore.com/_llms/secure/threat-model.md): Attacker goals, the mechanism that refuses each one, and the residual risk that remains. - [Tenant isolation](https://docs.veefore.com/_llms/secure/tenant-isolation.md): Two independent layers, either of which would be sufficient — and why that is the point. - [Secrets](https://docs.veefore.com/_llms/secure/secrets.md): Every place a secret could surface, and the specific mechanism that stops it. ### Access control - [RBAC](https://docs.veefore.com/_llms/secure/rbac.md): Seven built-in roles, 140-odd permissions, two extra gates, and how to build a custom role that is actually minimal. - [Step-up authentication](https://docs.veefore.com/_llms/secure/step-up.md): A fresh re-authentication at the moment of an irreversible operation, regardless of session age. - [SSO and SCIM](https://docs.veefore.com/_llms/secure/sso-and-scim.md): Let your identity provider own authentication and lifecycle — and understand the one thing SSO does not cover. - [Network](https://docs.veefore.com/_llms/secure/network.md): Who may reach Veefore, where Veefore may reach, and the six guards on the egress path. ### Assurance - [Audit integrity](https://docs.veefore.com/_llms/secure/audit-integrity.md): What the hash chain proves, what it does not, and the three things that close the gap. - [Compliance](https://docs.veefore.com/_llms/secure/compliance.md): Control mapping populated from live system state, not from a questionnaire. - [Responsible disclosure](https://docs.veefore.com/_llms/secure/disclosure.md): How to report a vulnerability, what is in scope, and what to expect back. ## Reference ### Reference - [Reference](https://docs.veefore.com/_llms/reference/index.md): Every endpoint, error code, permission, policy field, event type, CLI flag and environment variable. - [Conventions](https://docs.veefore.com/_llms/reference/conventions.md): Envelopes, pagination, idempotency, scope headers and correlation — the same everywhere, so they are not repeated per endpoint. - [Authentication](https://docs.veefore.com/_llms/reference/authentication.md): Three kinds of principal, three mechanisms, and the one that cannot step up. ### REST API - [REST API](https://docs.veefore.com/_llms/reference/api/index.md): Every endpoint Veefore serves, across 21 groups. - [A2A API](https://docs.veefore.com/_llms/reference/api/a2a.md): Agent-to-agent connections and passport verification. - [Actions API](https://docs.veefore.com/_llms/reference/api/actions.md): Search protected actions and run the enforcement pipeline directly. - [Admin API](https://docs.veefore.com/_llms/reference/api/admin.md): Compliance evidence, SSO, SCIM and network restrictions. - [Agents API](https://docs.veefore.com/_llms/reference/api/agents.md): Registration, lifecycle control and key rotation for agent identities. - [Approvals API](https://docs.veefore.com/_llms/reference/api/approvals.md): The human approval queue and its decisions. - [Audit API](https://docs.veefore.com/_llms/reference/api/audit.md): Search, export and verify the tamper-evident audit trail. - [Authentication API](https://docs.veefore.com/_llms/reference/api/authentication.md): Sessions, multi-factor authentication and step-up re-authentication for humans. - [Billing API](https://docs.veefore.com/_llms/reference/api/billing.md): Veefore usage metering and subscription state. - [Credentials API](https://docs.veefore.com/_llms/reference/api/credentials.md): Credential references, rotation and revocation. Secrets are never returned. - [Delegation API](https://docs.veefore.com/_llms/reference/api/delegation.md): Grant, narrow, inspect and revoke delegated authority. - [Gateway API](https://docs.veefore.com/_llms/reference/api/gateway.md): The enforcement plane. Agents talk here and nowhere else. - [MCP API](https://docs.veefore.com/_llms/reference/api/mcp.md): Model Context Protocol servers and per-tool authorization. - [Passport API](https://docs.veefore.com/_llms/reference/api/passport.md): Issue, read, export and verify the signed Agent Passport. - [Policy API](https://docs.veefore.com/_llms/reference/api/policy.md): Author, version, simulate, test, activate and roll back policy. - [Registry API](https://docs.veefore.com/_llms/reference/api/registry.md): The private agent registry for internal discovery. - [Risk API](https://docs.veefore.com/_llms/reference/api/risk.md): Risk scores, the signals behind them, and the weights you control. - [Security API](https://docs.veefore.com/_llms/reference/api/security.md): Security Center, incidents and emergency controls. - [Tenancy API](https://docs.veefore.com/_llms/reference/api/tenancy.md): Organizations, workspaces, environments and the enforcement mode of each. - [Tools API](https://docs.veefore.com/_llms/reference/api/tools.md): The registry of what an agent is allowed to call. - [Trust API](https://docs.veefore.com/_llms/reference/api/trust.md): Trust evidence an agent has accumulated, and how to record more. - [Webhooks API](https://docs.veefore.com/_llms/reference/api/webhooks.md): Subscriptions, signing secrets and delivery. ### Generated registries - [CLI reference](https://docs.veefore.com/_llms/reference/cli.md): All 16 `veefore` commands, their options and examples. - [Error codes](https://docs.veefore.com/_llms/reference/errors.md): All 57 error codes Veefore returns, what each means and what to do about it. - [Permissions and roles](https://docs.veefore.com/_llms/reference/permissions.md): All 109 permissions, the 7 built-in roles, and which are high impact. - [Policy fields](https://docs.veefore.com/_llms/reference/policy-fields.md): All 61 fields a policy rule can test, with their types and operators. - [Policy templates](https://docs.veefore.com/_llms/reference/policy-templates.md): The 5 built-in templates, their rules and when to reach for each. - [Event types](https://docs.veefore.com/_llms/reference/events.md): All 156 audit event types, and the 32 you can subscribe a webhook to. - [Configuration reference](https://docs.veefore.com/_llms/reference/configuration.md): All 103 environment variables Veefore reads, with their defaults. ## Architecture ### System design - [Architecture](https://docs.veefore.com/_llms/architecture/index.md): How Veefore is built, why it is built that way, and where each decision is recorded. - [Request path](https://docs.veefore.com/_llms/architecture/request-path.md): One protected action, traced from the agent's process to your downstream and back. - [Data model](https://docs.veefore.com/_llms/architecture/data-model.md): The tables, how they relate, and the structural rule about where an amount is allowed to exist. - [Repository layout](https://docs.veefore.com/_llms/architecture/repository-layout.md): Where everything lives, and the dependency direction that keeps it that way. - [Testing strategy](https://docs.veefore.com/_llms/architecture/testing-strategy.md): Twenty-three gates, seven suites, five smoke tests and two audits — and what each one actually proves. - [Changelog](https://docs.veefore.com/_llms/architecture/changelog.md): What shipped, and what changed in the documentation. ### Decision records - [Decision records](https://docs.veefore.com/_llms/architecture/adr/index.md): Thirteen architecture decisions, each with its context, alternatives and accepted consequences. - [ADR 0001: Scope boundaries](https://docs.veefore.com/_llms/architecture/adr/0001-scope-boundaries.md): Veefore is identity, authority, policy and enforcement. The adjacent products it deliberately is not, and the build gate that keeps it that way. - [ADR 0002: Gateway architecture](https://docs.veefore.com/_llms/architecture/adr/0002-gateway-architecture.md): Two separate planes, built from one image, with the credential broker placed after everything that can refuse. - [ADR 0003: Policy engine](https://docs.veefore.com/_llms/architecture/adr/0003-policy-engine.md): A TypeScript intermediate representation evaluated in-process, with Rego as an export — and why not OPA as the engine. - [ADR 0004: Delegation semantics](https://docs.veefore.com/_llms/architecture/adr/0004-delegation-semantics.md): Refuse an escalating grant rather than clamping it, intersect every hop, and cascade revocation immediately. - [ADR 0005: Identity model](https://docs.veefore.com/_llms/architecture/adr/0005-identity-model.md): One Ed25519 key pair per agent, generated locally, with no refresh token and terminal revocation. - [ADR 0006: Passport format](https://docs.veefore.com/_llms/architecture/adr/0006-passport-format.md): A signed, versioned snapshot for presenting identity to third parties — and deliberately never the authorization decision. - [ADR 0007: Trust evidence](https://docs.veefore.com/_llms/architecture/adr/0007-trust-evidence.md): Typed, expiring, attributable evidence that policy can require — rather than a reputation score nobody can act on. - [ADR 0008: Credential broker](https://docs.veefore.com/_llms/architecture/adr/0008-credential-broker.md): Short-lived scoped leases issued to the tool runtime after every refusal — never to the agent, and never early. - [ADR 0009: MCP architecture](https://docs.veefore.com/_llms/architecture/adr/0009-mcp-architecture.md): An MCP server is an untrusted tool source. Discovery proposes; a human authorizes. - [ADR 0010: A2A architecture](https://docs.veefore.com/_llms/architecture/adr/0010-a2a-architecture.md): Agent-to-agent invocation through the gateway, with a key registered out of band and a connection that is unusable until it verifies. - [ADR 0011: Tenant isolation](https://docs.veefore.com/_llms/architecture/adr/0011-tenant-isolation.md): A repository layer that refuses an unscoped query, plus row-level security underneath it — either of which would be sufficient. - [ADR 0012: Audit architecture](https://docs.veefore.com/_llms/architecture/adr/0012-audit-architecture.md): A keyed hash chain in PostgreSQL, append-only in practice, with redaction applied on ingest rather than on output. - [ADR 0013: Deployment model](https://docs.veefore.com/_llms/architecture/adr/0013-deployment-model.md): Stateless planes, one image, forward-only migrations, and enforcement mode stored as data rather than configuration.