VEX Protocol·Design-partner evaluation
The protocollayer for reviewableautonomous action.
VEX puts a control point between what the agent suggests and what actually runs, then preserves verifiable evidence for governed actions.
- Pre-execution controlAuthorization before execution.
- Verifiable offlineEvidence can be checked offline.
- Portable evidenceInspectable across systems.
Actor, scope, and decision basis.
Proposed action as structured context.
Principal bound to the evidence record.
Outcome preserved as cryptographically verifiable evidence for review.
Why it matters
VEX changes the contract between an agent and a privileged system.
Instead of asking whether a model looked aligned after the fact, VEX places an explicit governance layer between suggested action and real consequence.
- 01
Proposal is no longer permission
The agent can propose an action, but proposal alone does not authorize execution. Consequential work has to cross an explicit control point first.
- 02
Authorization moves outside the model
Policy, scope, identity, and risk are evaluated by infrastructure the model cannot rewrite, flatter, or reason its way around.
- 03
The result becomes a reviewable record
Selected allowed, blocked, or escalated actions can produce evidence when the deployment routes them through the VEX-governed boundary.
What an artifact looks like
In VEX-governed pilot flows, selected governed execution events can produce cryptographically verifiable evidence. Here is an illustrative example of what that evidence structure can look like.
- network:
- provn-localnet
- ts:
- 2026-05-24T14:32:17.843Z
- authorized_principal:
- org:provn:platform-team
- governed_scope:
- filesystem:read:/var/data/invoices/*
- permitted_actions:
- [fs_read, api_call, db_query]
- verification:
- 0x9a2f...b7e1
- authorized_goal:
- Generate monthly compliance report
- session_context:
- sess-7c4a-9f2b-11e3
- constraints:
- read-only, no-egress, 30s-timeout
- verification:
- 0x3d4e...a9c2
- agent_reference:
- agent:provn:v1:0x7a9c...
- trust_context:
- verified:ref-ABCD-1234
- runtime_context:
- runtime:verified:0x3f2a
- verification:
- 0x5e6f...d3a1
- integrity_root:
- 0x1a2b3c...4d5e6f
- sequence_anchor:
- 0x9f8e7d...6c5b4a
- record_count:
- 14
- verification:
- 0x7b8c...e2f1
- integrity_root
- 0x1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
- prev_reference
- 0x9f8e7d6c5b4a39281726354
- verification
- 0x7b8c9d0e1f2a3b4c5d6e7f8
Execution flow
Four steps between model output and consequence.
VEX is intentionally small at the control point. Its job is to make the execution boundary explicit, enforceable, and inspectable before the system acts.
Proposal
The agent proposes an action, target, and intended effect. Proposal is captured before any privileged execution begins.
Scope check
Runtime context, resource constraints, and execution scope are checked against the declared request.
Independent authorization
Policy controls outside the agent boundary determine whether the action is permitted before any privileged execution begins.
Evidence preservation
Execution outcome and decision basis are preserved as reviewable evidence - including denied, escalated, or blocked paths where relevant.
Architecture position
VEX is the control point, not the entire stack.
ProvnAI contributes across adjacent governance work, but VEX has a narrow and valuable role: it sits where proposed action becomes real execution and makes that boundary externally governable.
Policy models and control assumptions that define what actions are permitted and who can authorize them.
The execution boundary layer where proposed action is independently authorized and preserved as verifiable evidence in governed flows.
External authority and review services that complement governed execution.
Product maturity
Clean lines between what is shipped and what is in pilot.
The protocol story is strongest when it is precise. This roadmap distinguishes what is implemented in the current evaluation surface from what remains scope-dependent or exploratory.
- Controlled execution scope in protocol artifacts
- Selected cryptographic evidence artifacts
- Portable verification artifacts
- Local verification tooling
- Enterprise deployment patterns
- Design partner integrations
- Policy and review workflows
Audience
Built for environments where AI consequence is material.
VEX is not a general-purpose chatbot feature. It is for teams that need a protocol surface around real execution, policy, and evidentiary review.
Enterprise platform teams
Teams deploying internal agents that can touch repositories, tickets, data stores, cloud APIs, or operational workflows.
Public sector and regulated environments
Organizations that need explicit authorization, review paths, and evidence records before autonomous systems create real-world consequences.
Research, standards, and assurance collaborators
Groups exploring verifiable execution, auditability, and protocol-level controls for increasingly autonomous AI systems.
What is VEX Protocol?
VEX Protocol is an execution boundary governance system for autonomous AI agents. In VEX-governed pilot flows, consequence-bearing actions can be required to pass an explicit authorization boundary before execution, with verifiable evidence of what crossed that boundary.
What are Evidence Capsules?
In VEX-governed pilot flows, selected governed actions can produce tamper-evident, verifiable Evidence Capsule records. Each capsule is designed to preserve governance context: what was authorized, what was proposed, and what crossed the boundary. Review and compliance use remains deployment-specific.
How does VEX Protocol support EU AI Act compliance?
VEX Protocol's Evidence Capsule architecture can support EU AI Act governance workflows for high-risk AI systems: Article 13 transparency, Article 14 human oversight, and Article 17 quality management. It provides technical evidence architecture, not legal advice, certification, or a guarantee of regulatory compliance.
What is the difference between McpVanguard and VEX Protocol?
McpVanguard is a real-time security proxy that can block unsafe routed MCP tool calls at the execution boundary. VEX Protocol is a governance and evidence protocol for governed actions that require explicit authorization and verifiable evidence. They are complementary: McpVanguard secures the tool-call surface; VEX Protocol governs and preserves evidence about what the agent was authorized to do.
Secure your
autonomous AI agents
We are exploring a limited number of scoped design-partner evaluations for governed agent execution. Tell us what workflow you are assessing.
Enterprise & Startup Evaluations
Deploy controlled execution for your agent stack. We work directly with your security and platform teams.
Public-Sector & Consortium
Evidence and governance mapping for teams working toward EU AI Act, DORA, and SOC 2 control objectives.
Architecture Collaboration
Formal verification, ZK proof systems, and protocol-level trust. We support open academic and institutional collaboration.
Discuss a pilot deployment
Book a 30-minute technical discussion with our founding team to map out a VEX Protocol or McpVanguard deployment.
Opens Cal.com — please include what you are building.
An evidence artifact for selected VEX-governed flows.
Authorization policies that govern which tools and actions an agent is permitted to execute.
The binding of agentic sessions to authorized goals — ensuring actions remain within the declared scope.
Tamper-evident execution records preserving what crossed the boundary during governed actions.
Cryptographic integrity mechanism for execution logs, making post-hoc modification detectable.
TEE-backed isolation option under pilot and research evaluation.
The execution boundary for selected VEX-governed transitions.