llms.txt

# Veto

Veto is the policy runtime for AI agent tool calls — write deny rules in plain English, enforce them deterministically, in 5 lines of code.

Veto governs tool calls. It sits between the AI agent and tool execution, evaluates tool name + arguments against deterministic policy, and returns allow, deny, warn/log, or require_approval before handlers run.

- Website: https://veto.so
- Docs: https://docs.veto.so
- GitHub: https://github.com/PlawIO/veto
- License: Apache-2.0

## Installation

### TypeScript SDK
```bash
npm install veto-sdk
```

### Python SDK
```bash
pip install veto
```

### CLI
```bash
npm install -g veto-cli
```

## Public entrypoint

### TypeScript

```ts
import { protect } from 'veto-sdk';

const safeTools = await protect(tools);
```

### Python

```python
from veto import protect

safe = await protect(tools)
```

`protect(tools)` loads local `./veto/veto.config.yaml` and `./veto/rules/*.yaml` when present. Without local policy or explicit options, it uses `@veto/safe-defaults` in observe mode, warning/logging suspicious destructive shell, sensitive file mutation, database mutation, and network money-movement patterns without hard blocking.

## Add local policy

```bash
npx veto init
```

Creates `./veto/veto.config.yaml` and `./veto/rules/defaults.yaml` with strict local deny rules.

```yaml
rules:
  - id: block-large-transfers
    name: Block transfers over $1,000
    enabled: true
    severity: high
    action: block
    tools: [transfer_funds]
    conditions:
      - field: arguments.amount
        operator: greater_than
        value: 1000
```

## Advanced SDK instance

`Veto.init()` and `.wrap()` are supported for advanced/internal-facing integrations that need an explicit runtime instance, direct `guard()` calls, audit export, event hooks, or self-host/cloud options.

```ts
import { Veto } from 'veto-sdk';

const veto = await Veto.init({ configDir: './veto', mode: 'strict' });
const safeTools = veto.wrap(tools);
const result = await veto.guard('transfer_funds', { amount: 5000 });
```

## Actions

- `block`: deny the tool call with a reason
- `allow`: permit the tool call
- `warn`: allow but log a warning
- `log`: allow and log the match
- `require_approval`: route to human approval
- `require_payment`: gate behind a payment protocol

## BYOC / self-host boundary

Customer-plane deployments are outbound-only. No customer policy, decision row, tool args, agent IDs, user IDs, Slack content, prompts, environment variables, or secrets cross to Plaw. The heartbeat schema contains only `instance_uuid`, `license_id`, `decision_count_30d`, `sdk_version`, `operator_version`, and `timestamp`.