We don't make agents. We govern them.
One memory layer across Claude, ChatGPT, Gemini, Perplexity, and your browser. One audit log for every action they take. One AI Bill of Materials for every agent your organization runs. Built for the enterprise — usable on day one by anyone.
Four major incumbents shipped “agents + context + governance, in our stack” in twelve months. Each one can govern its own agents — none can credibly govern the competitor's without telling you to throw out the competitor. But every enterprise runs Copilot in M365, ChatGPT for research, Claude in Cursor, Gemini in Workspace, and a half-dozen line-of-business AI tools nobody centrally inventoried. The governance layer above all of them is structurally neutral. That's the layer we build.
Vaii Runners are sandboxed cloud agents that you spin up by the dozen. Each runs a real agent CLI — Claude Code, Codex, Cursor, Aider, your choice — in its own E2B sandbox, with the Vaii MCP server pre-wired as the governance gate. Every recall, every tool call, every approval flows back through your policy. We use it to build Vaii itself: parallelizable feature work that used to take a sprint now takes the time it takes to review the diff.
N agents, one policy.
Spin up runners for every parallelizable task — admin pages, endpoints, scripts, tests — and watch them work simultaneously. Same audit, same approvals, same memory across all of them.
Claude, Codex, Cursor, or whatever ships next.
The runner contract is the same regardless of which agent CLI runs inside. Pick the model that's best for the task; switch tomorrow without rewriting the orchestration.
Per-runner-hour pricing.
Governance tier is per-human-seat. Velocity tier is per-runner-hour. Use both, or just the one you need. Your CFO sees agents in the GL alongside contractors.
Shadow AI just became the most expensive line on the breach report — IBM's 2026 Cost-of-a-Data-Breach figure puts the premium at $670,000 per breach. 75% of orgs have an AI governance body; only 12% call it mature. Every team is bolting on AI assistants — Claude Desktop, ChatGPT Connectors, in-house agents, browser extensions, embedded AI in sanctioned SaaS — each one with its own memory, its own permissions, its own audit trail. Your security team can't see what's connected, what it remembers, or what it did yesterday at 3am.
“If your DSPM, DLP, and AI-SPM are three separate programs run by three separate teams, you're already behind.”
Identity is not authorization.
Every agent is a first-class principal with scoped tokens (read_memory, write_memory, mint_tokens, manage_org, view_audit) and per-tool invoke:* allowlists. Issued from your console; revocable in one click. Tool calls outside the allowlist return 403 and land in the audit log as decision=deny.
AI governance is data governance.
A shared context layer that follows your team across LLMs. Save explicitly, capture passively, search semantically. Per-packet sensitivity classification (public / internal / confidential / secret) and per-principal clearance — recall returns only what the caller is cleared for. Retention, legal hold, and per-region anchoring from day one.
An AI Bill of Materials for every agent your organization runs.
Append-only audit log enforced at the database layer — not just at the API. Plus an Agent Bill of Materials (ABOM) — vendor-neutral inventory of every Claude, ChatGPT, Cursor, Studio, or third-party agent, with CycloneDX 1.5 export for procurement and security review.
A single Chrome install. Browse normally — pages get captured into your memory layer (with a one-click pause and a default-on privacy blocklist for banking, healthcare, webmail).
On chatgpt.com and claude.ai, a one-click button injects a connector token — no copy-pasting URLs or bearer tokens. Each LLM now reads from the same memory.
The admin app shows every principal, every connected agent (ABOM), every action (audit log), and real per-call LLM spend captured from the model's own token usage (usage meter). One pane. Built for security teams, not data scientists.
You can't govern model behavior if you can't govern the data flowing into it. Every primitive below is a real database column, a real DB-role grant, or a real schema constraint — not a checkbox in a sales spreadsheet.
Enforced by a Postgres trigger that rejects every UPDATE, DELETE, and TRUNCATE on audit_events — for every role, including the app's own connection. Not just an app-level promise. policy_decision column carries allow / allow_with_warning / denied_advisory / deny — the denial is a column value, not a log line.
invoke:<tool> allowlist scopes per token. A read-only-recall token cannot call remember even if it has the same bearer surface. Denials land in audit as decision=deny with the missing scope in drift_flags.
Per-packet classification (public / internal / confidential / secret) + per-principal clearance (derived from role or explicit override). Recall filters at query time and reports redacted_count back to the caller. The deny on data, not just on calls.
Org-wide agent inventory, exportable as CycloneDX 1.5 ML-BOM. Plus a shadow-agents view showing every agent_id writing to your memory layer without a formal ABOM entry.
Every organization carries a region. Single region today; designed for sharding when customers demand it.
GET /v1/me/export ships full data dumps. DELETE /v1/me with typed confirmation, last-owner guards, audit preservation.
Email-domain-routed sign-in via Okta, Azure AD, Google Workspace, SAML — anything WorkOS connects to.
MCP clients enroll dynamically via RFC 7591. Refresh-token rotation with replay detection.
Five-scope baseline (read/write/mint/manage/view-audit) plus invoke:* allowlists. No privilege escalation on mint — except invoke:* scopes (narrowing-only) which any mint_tokens caller can grant.
Every memory carries retention_days, expires_at, legal_hold, archived_at. Enforcement landed; controls in the admin.
Per-principal usage meter splits OpenAI embeddings from Anthropic agent calls. Hard caps per plan; visible monthly burn.
Identity. Memory. Audit. For every AI agent your organization runs.