Vassiliy Lakhonin

Vizier by Vassiliy Lakhonin / experimental v0.1

Put a policy check between an AI agent and the tool it wants to run.

Vizier evaluates a proposed action against supplied authority. It returns ALLOW, REVIEW, or BLOCK before a tool, API, MCP server, A2A agent, or internal service runs.

Bring one write-capable workflow Inspect the live API contract

Current status: live experimental service, no paying customers yet. Verification calls require a private integration credential; no public demo credential is issued.

The checkpoint is outside the model.

The agent proposes. Deterministic code decides. The caller controls execution.

  1. 01

    Propose

    The caller sends agent identity, principal, action, target, parameters, authority, and context.

  2. 02

    Decide

    Vizier evaluates explicit rules and returns policy results, reason codes, risk, and a request-bound receipt.

  3. 03

    Enforce

    The caller executes only after a valid ALLOW. A timeout, malformed response, REVIEW, or BLOCK stops the action.

The first test

Use one workflow in shadow mode.

Start with a workflow that can deploy code, change infrastructure or data, modify permissions, send an external message, or trigger another system.

Vizier observes the proposed action and records its decision without blocking the existing path. The pilot answers four operational questions:

  • Did the current process send an action forward that policy would stop?
  • Was a human asked to review the exact payload, target, and environment?
  • Could the agent bypass the checkpoint through direct credentials or shell access?
  • Would the team keep the check in the normal path after the test?

This is a build-to-learn pilot offer. Scope, safe data handling, timing, and fee are agreed against the workflow before work starts.

A narrow fit.

The page is for teams with external side effects, not every team using an LLM.

Use this test when

  • An agent can write to production or valuable staging state.
  • Approval currently lives in a prompt, chat message, or manual checklist.
  • A platform, SRE, security, or AI operations owner carries the consequence of a bad action.
  • You can provide one redacted action trace and the current approval rule.

Do not use it when

  • The agent is read-only and has no external side effect.
  • Existing IAM and policy enforcement already cover the exact action and payload.
  • You need factuality checking, content moderation, or post-execution proof.
  • No named person owns the action, incident, or pilot decision.

Technical contract

One request before execution.

The default decision path does not call an LLM. It checks delegated action types, principal presence, value limits, target restrictions, sensitive-action authority, and the authenticated integration boundary.

REST documentation A2A Agent Card Service health 
const decision = await vizier.verify(action);

if (decision.decision !== "ALLOW") {
  stopOrQueueForReview(decision);
  return;
}

await executeAction();

Public discovery and documentation are open. The verification endpoint requires a backend credential kept outside the action-taking agent.

What v0.1 does not prove

The integrating application supplies the authority. Vizier authenticates that integration, not the principal behind every delegation.

Receipts bind the response to the submitted request with SHA-256. They are not stored, signed, or independently timestamped in v0.1.

A process with unrestricted shell access and cloud credentials can bypass a wrapper. Vizier is an enforcement point only when the agent cannot reach the protected system through another path.

Vizier does not verify factual truth, inspect live sources, prove a post-execution outcome, or provide legal, compliance, security, financial, or investment clearance. REVIEW requires a human decision.

Questions before a pilot.

The current limits matter more than the long-term roadmap.

Does Vizier replace IAM or an API gateway?

No. IAM still controls credentials and resource access. Vizier evaluates the proposed agent action against supplied authority immediately before execution.

Does an ALLOW prove the action completed correctly?

No. It proves only that the submitted action passed the submitted policy. Post-execution evidence is a separate product question that the pilot should measure.

Can I send production secrets in the first email?

No. Start with a redacted workflow description. The transfer channel, retention boundary, and permitted test data must be agreed first.

Is Vizier ready for a company-wide rollout?

No. v0.1 is an experimental service for one bounded workflow. It has no independent principal authentication, durable policy store, signed delegation, signed receipts, billing, dashboard, SLA, SAML, or SOC 2 claim.

Next step

Bring the next action that touches a live system.

Describe the agent, the external side effect, the current approval rule, the last failure or near miss, and who owns the final decision. Do not send secrets or sensitive logs in the first message.

Open the pilot request

Almaty, Kazakhstan · UTC+5 · Updated 9 August 2026