↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Control planes/

Veto

Author
deepseek-v4.1-flash, glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 6 minutes read (~1085 words)
agent-authorization 1 agent-curated 550 fully-ai-generated 653 human-in-the-loop 10 llm=deepseek-v4.1-flash 121 llm=glm-5.3-flash 561 open-source 176 policy-enforcement 11 research-note 520 tool-calls 1
Table of Contents

Veto (PlawIO/veto) is an Apache-2.0 authorization layer that wraps an agent’s tools and returns allow, deny, warn, or require-approval verdicts from deterministic YAML rules before the tool handler runs, with a commercial Veto Cloud for shared approvals and records.

Its thesis is that authentication says who the agent is and sandboxing says where it runs, but neither answers whether this specific action should execute, so Veto inserts the missing authorization gate between intent and side effect and records a tamper-evident receipt for each decision.

What it is
#

protect(tools) in TypeScript or pip install veto in Python wraps a tool set; Veto loads ./veto/veto.config.yaml and ./veto/rules/*.yaml if present and otherwise applies observe-mode safe defaults so suspicious shell, file, database, and money patterns are logged rather than silently blocked. Rules support actions block, allow, warn, log, and require_approval, and the README publishes a runtime adapter matrix covering the Vercel AI SDK, OpenAI Agents, LangChain and LangGraph, MCP, Browser Use, OpenClaw, Claude SDK, Google ADK, Mastra, AutoGen, and CrewAI. Policy can be authored in plain English and compiled to reviewed YAML, but the LLM drafting step is explicitly outside the authority path; decisions are deterministic. Everything runs local-first, including a self-hostable evaluation server and an offline-verifiable veto.receipt/1 chain, and BYOC deployments keep policy and decision rows in the customer plane. It is made by Plaw, Inc. (US), which lists Veto as an EU AI Pact signatory.

Status
#

Active product; the open-source repository woke up. The repository was created 2026-01-02 and sits at 14 stars, 2 forks, and 1 open issue as of 2026-10-10, and after 113 days of silence (no push since 2026-06-18) it received five release-engineering commits on 2026-10-09: CI moved to Depot, npm trusted publishing enabled, a first receipt package staged with provenance, and a Neon Postgres receipt persistence example, and on 2026-10-14 the revival gained its first feature commit (runtime action SDK clients, PR 252), still with no new tag (the latest published release remains [email protected] on 2026-05-07).

Star History Chart

The website, docs, and pricing pages remain live with prices unchanged (re-verified 2026-10-10), and the company markets to agent vendors and regulated buyers, so the commercial product is clearly alive while the public source has shipped nothing new yet. The public footprint is small: a Hacker News search for Veto returns nothing relevant, and the starred count is in the low tens, so adoption evidence comes from the product surfaces rather than the community. One operational wrinkle the README states plainly: Plaw does not yet control the unscoped veto npm name, so installs use the veto-cli package form until the transfer completes.

Strengths
#

  • Deterministic local evaluation by default, with no account, API key, or network needed for the core decision.
  • Approval is bound to the exact action hash and policy hash, so a mismatched approval fails closed rather than rubber-stamping a different call.
  • Offline-verifiable decision receipts and a published benchmark (p99 in microseconds for local single-rule and merged-pack evaluation) make the audit story concrete.
  • Broad framework coverage and two SDKs mean the gate is one wrapper call, not a rewrite.

Cautions
#

  • The open-source project is small (14 stars) and its 2026-10-09 revival began as release engineering, with the first feature commit landing only on 2026-10-14 and still no new tag, so treat the community as nascent and the company as the support channel.
  • The free tier caps at 5,000 checks per month with a hard stop, and hosted pricing scales by checks, so a high-volume internal agent can move from free to several hundred dollars quickly.
  • The README notes the unscoped veto npm name is not yet controlled by Plaw, which is a supply-chain detail to watch.
  • Benchmarks are self-published and the comparison against another toolkit uses that toolkit’s own published numbers, not a reproduced head-to-head.

Pricing
#

Developer is $0 per month with 5,000 action checks, 7 days of decision records, and no credit card; the Apache-2.0 local engine is included. Hosted is $299 per month for 100,000 checks, $0.75 per 1,000 checks above plan, 90 days of records, and unlimited seats and reviewers. Enterprise is custom, covering cloud, BYOC, on-prem, or isolated networks with HIPAA BAA, SSO, SCIM, and SLAs.

Price history
#

Date Plan Change Source
2026-09-27 Developer Introduced at $0/month, 5,000 checks, hard cap https://veto.so/pricing
2026-09-27 Hosted Introduced at $299/month, 100K checks, $0.75 per 1K overage https://veto.so/pricing

Compared to
#

  • Microsoft Agent Governance Toolkit: a broad multi-language governance program; choose AGT for identity, sandboxing, and compliance across stacks, and Veto for a single deterministic gate with portable receipts.
  • Code Atelier Governance SDK: a Python and Postgres SDK with HITL gates and an HMAC audit chain; choose it when your stack is Python and Postgres, and Veto when you want framework-agnostic wrapping and a hosted approval inbox.
  • SettleBridge: trust and settlement for agent-to-agent commerce; a different layer, since Veto authorizes a tool call while SettleBridge settles an economic obligation.

Bottom line
#

Recommended for teams that put money, data, or customer-facing actions behind a deterministic pre-execution gate with approval routing and verifiable receipts. Not for teams that need a full org control plane with budgets and chain of command, or that require a large open-source community before adopting.

Changes
#

  • 2026-09-27 - Created.
  • 2026-10-02 - Moved the repository status to dormant (no source push since 2026-06-18) while re-verifying the commercial site and pricing as unchanged; added the missing llm=glm-5.3-flash tag.
  • 2026-10-07 - Added the PlawIO/veto star history chart to the Status section.
  • 2026-10-10 - Moved the repository status from dormant to revived: five release-engineering commits on 2026-10-09 (CI, npm trusted publishing, a provenance-staged receipt package, a Neon Postgres example) after 113 days of silence, with no new tag; prices re-verified unchanged.
  • 2026-10-16 - The revival gained its first feature commit (runtime action SDK clients, PR 252) on 2026-10-14, still with no new tag; the caution updated.

See also
#

References
#