Skip to content
VB-OSVB-OSVB-OS Docs

AI Agent Governance with Deterministic Execution Authority

AI agents take consequential actions: approving transactions, dispatching workflows, modifying infrastructure, communicating with customers. As agents gain autonomy, the question shifts from “can the agent do this?” to “should this action be authorized to proceed?”

VB-OS answers that question with a deterministic, replayable verdict.

The Architectural Problem

Section titled “The Architectural Problem”

For consequential agent actions, governance increasingly needs to answer two questions at execution time:

  1. Is this action authorized? — a binary determination, not a probability
  2. Can you prove it later? — reproducibility, not just logging

Traditional approaches conflate these questions or answer only the first:

  • Output filtering evaluates agent outputs after generation. The filtering mechanism may use classifiers, heuristic rules, or model-based evaluation. These mechanisms can reduce undesirable outcomes, but they do not inherently produce deterministic or replayable authorization decisions.

  • Orchestration-level checks embed authorization logic within the agent framework itself. The system that produces the action also determines whether the action should proceed. Authorization logic is coupled to the agent’s own execution context.

VB-OS separates the concerns. The agent proposes an action. VB-OS independently evaluates whether the action is authorized under the applicable verification boundary. The proposing system does not participate in the semantic justification of its own output.

How It Works

Section titled “How It Works”
Agent ──▶ Proposes action with evidence
              │
              ▼
         VB-OS Boundary
              │
         ┌────┴────┐
         │         │
      ASSERT     DEFER
         │         │
    Action      Action
   executes    withheld

The agent submits structured evidence describing the proposed action — for example, the action type, risk classification, actor identity, and environmental context. VB-OS evaluates this evidence through its three-stage pipeline:

  1. Admissibility — is all required evidence present?
  2. Prohibition — is any prohibited evidence present?
  3. Predicate evaluation — does the evidence satisfy all boundary conditions?

The result is ASSERT (action authorized) or DEFER (action withheld). There is no partial authorization.

What This Gives You

Section titled “What This Gives You”

Deterministic verdicts. Identical frozen inputs evaluated under the same boundary version with the same evaluator artifact produce identical observable results. The authorization verdict depends on the evidence and verification boundary, not on the agent’s internal reasoning process.

Model independence. Swap the agent model, upgrade the LLM, change the orchestration framework — the verification boundary is unchanged. Authorization logic is decoupled from inference logic.

Replayable decisions. Every authorization is bound to immutable, content-addressed artifacts: the evidence, the exact boundary version, the evaluator identity, and the verdict. With the required frozen inputs and evaluator artifacts, the decision can be reproduced months or years later with identical observable results.

Fail-closed behavior. If required evidence is missing, the result is DEFER — not a best guess. Integrity failures halt evaluation immediately.

Agent Governance vs. Agent Orchestration

Section titled “Agent Governance vs. Agent Orchestration”

VB-OS does not create, plan, or orchestrate agent behavior. It does not manage agent memory, tool selection, task decomposition, or multi-step reasoning.

Agent frameworks handle orchestration: deciding what the agent should attempt. VB-OS handles authorization: determining whether a specific proposed action is permitted to execute under the governing verification boundary.

These are complementary, not competing. An agent framework proposes actions; VB-OS independently authorizes or withholds them.

When ASSERT Does Not Mean “Safe”

Section titled “When ASSERT Does Not Mean “Safe””

ASSERT means the structured evidence satisfies the verification boundary. It does not mean:

  • The action is globally correct
  • The agent’s reasoning was sound
  • The outcome will be desirable
  • The actor is authenticated (VB-OS does not replace access controls)

VB-OS verifies certifiability under declared conditions. It makes no claims about truth beyond what can be externally justified under those conditions.

Next Steps

Section titled “Next Steps”