The trust layer for agents you didn’t write
Run agents you
can’t trust. On
infrastructure you can.
A sealed runtime and open protocol that lets a platform run anyone’s agent next to real data — and certify, per run, that it never leaked, acted, or wandered. Containment you can attest. Trust an ecosystem can build on.
bubblewrap · seccomp · cgroup v2 · per-tenant egress · append-only audit
Not a way to build agents. The way to certify them.
A box that opens, does one job, and burns.
The agent is untrusted, so it runs inside a boundary the kernel enforces — bubblewrap, seccomp, cgroups — not a policy doc you hope holds.
Signed
Every request is signed. No valid signature, no entry — one inbound door, nothing else.
Sealed
A fresh sandbox per run: no disk, no peers, no network except one guarded exit. The agent starts with nothing.
Routed
It can reach exactly one thing — the model you approved. Internal services, metadata, other tenants: denied at the wire.
Gated
If it must act, it proposes — a policy gate you control decides and executes. The agent never holds the keys.
Scrubbed
Secret-shaped values are stripped from every reply before it leaves the box. Nothing smuggles out.
Sealed shut
The box is destroyed. Keys and prompts in memory vanish with it — and a signed receipt lands. Never the content.
Certify what an agent can't do. Not whether it's any good.
Containment is a claim about boundaries, not judgment — that's exactly why an auditor and an insurer can take it to the bank. Quality is a layer we measure separately.
Certified it cannot act.
The agent observes and reports. Actuation isn’t a permission you can grant — it isn’t on the path. The purest, most-underwritable guarantee there is: an absolute claim about what could not have happened.
The agent proposes. A gate disposes.
When agents must act, they don’t. They emit an intent; a policy gate you control decides, executes, logs, and can reverse it. Certified: every action passed a gate the agent couldn’t bypass — and it never held the credential.
The agent proposes — it never disposes. That one rule is the whole product: ride the action wave without ever being the thing that pulls the trigger.
Built to be trusted with the part that matters.
A protocol, not a vendor.
The spec and reference runtime are open. The drill suite IS the definition of “contained.” Implement it yourself or run ours — certification travels across the ecosystem, not one vendor's walls.
What auditors cite.
Isolation you can prove, not promise. Every boundary — cross-tenant, egress, actuation, exfiltration — is enforced by a drill that fails the build the moment it regresses.
What insurers price.
Lowest-level control of the sandbox, down to the seccomp filter. You can't underwrite what you don't own — so we own the whole stack, and the certification is built to be priced.
Keep the data
in your walls.
Point an agent at a model you host — Ollama, vLLM, your own endpoint — and the prompt never leaves your infrastructure. No third party ever sees it. Same containment, zero external exposure. The story a regulated bank or hospital can sign.
How isolation is enforced →Running agents you didn’t write?
Vyce is in private access while we onboard the first hosts. Tell us what you’re running — we’ll get you contained.