Skip to main content
Veto is Ona’s kernel-level enforcement engine for AI agents. It runs as a Linux Security Module (LSM) inside the environment kernel, below the agent, below userspace. The LLM cannot bypass or disable it. AI agents reason about security boundaries and work around them. Traditional runtime security operates above the agent, making it observable and evadable. Veto moves enforcement below the agent’s reach.

​
Capabilities

Executable deny list
Block specific binaries by content hash. Rename-resistant and symlink-resistant. The check and the block happen in the same kernel call, so there is no gap to exploit.
Learn more →

​
Kernel-level enforcement

When enforcement operates above the agent, the agent can discover and circumvent it. Path-based deny lists fall to renamed binaries. Userspace sandboxes can be disabled. Veto enforces at the syscall level. The agent cannot unload the LSM, modify its configuration, or observe whether an action was flagged. The kernel is the last trust boundary before hardware.

​
Watch: Claude Code vs. Veto

Leonardo walks through how Claude Code bypasses traditional guardrails and how Veto enforces controls from inside the kernel.

​
Further reading