veto

Python policy runtime for AI agent tool calls. Veto wraps your tools, evaluates deterministic policy before each handler runs, and preserves the original tool interface.

Install

pip install veto

With provider extras:

pip install veto[openai]
pip install veto[anthropic]
pip install veto[gemini]
pip install veto[all]

Quick start

from veto import protect

safe = await protect(tools)
agent = create_agent(tools=safe)

protect(tools) is the public entrypoint. It loads ./veto/veto.config.yaml and ./veto/rules/*.yaml when present. Without local policy or explicit options, it uses the built-in @veto/safe-defaults pack in observe mode: suspicious destructive shell, file, database, or money-movement network patterns are warned/logged, not blocked.

TypeScript parity

import { protect } from "veto-sdk";

const safeTools = await protect(tools);
const agent = createAgent({ tools: safeTools });

Local policy

veto init

rules:
  - id: limit-transfers
    name: Limit large transfers
    enabled: true
    severity: high
    action: block
    tools: [transfer_funds]
    conditions:
      - field: arguments.amount
        operator: greater_than
        value: 1000

Actions are block, allow, warn, log, and require_approval.

API

protect(tools, **kwargs)

from veto import protect

safe = await protect(tools)

Explicit policy source example:

safe = await protect(
    tools,
    rules=[
        {
            "id": "no-prod-deploy",
            "name": "Block direct production deploys",
            "enabled": True,
            "severity": "critical",
            "action": "block",
            "tools": ["deploy"],
            "conditions": [
                {"field": "arguments.environment", "operator": "equals", "value": "production"}
            ],
        }
    ],
    mode="strict",
)

Advanced: Veto.init() + .wrap()

Veto.init() remains supported for advanced/internal-facing integrations that need a reusable instance, direct guard() calls, event hooks, audit export, or explicit self-host/cloud configuration.

from veto import Veto, VetoOptions

veto = await Veto.init(VetoOptions(config_dir="./veto", mode="strict"))
safe = veto.wrap(tools)
result = await veto.guard("transfer_funds", {"amount": 1500})

Decision history

stats = veto.get_history_stats()
json_audit = veto.export_decisions("json")
csv_audit = veto.export_decisions("csv")

Decision export is local to your process unless you explicitly configure a remote endpoint.

Policy packs

Built-in packs include @veto/safe-defaults, @veto/coding-agent, @veto/financial, @veto/browser-automation, @veto/data-access, @veto/communication, and @veto/deployment.

Self-host / BYOC boundary

The SDK can point at a self-hosted PDP with endpoint, but customer-plane data stays in the customer environment unless you explicitly configure outbound integrations. Customer policy, decision rows, tool args, agent IDs, user IDs, Slack content, prompts, environment variables, and secrets do not cross to Plaw.

License

Apache-2.0