Validation Modes

Veto supports three validation modes, configured in veto.config.yaml:

validation:
  mode: "custom"  # "api", "custom", or "kernel"

API mode

Sends validation requests to the Veto server at POST /v1/validate.

validation:
  mode: "api"
  api:
    url: "https://api.runveto.com"
    key: "veto_abc123..."

Best for production deployments with the Veto dashboard. Provides:

• Centralized policy management
• Real-time decision logging
• Approval workflows for escalated calls
• Team-wide visibility via the dashboard at runveto.com

Custom mode

Calls an LLM provider directly from the SDK. No server needed.

validation:
  mode: "custom"

custom:
  provider: "openai"     # openai, anthropic, or gemini
  model: "gpt-4o-mini"

Supported providers:

Best for development and testing. Rules are evaluated locally using the LLM.

Kernel mode

Uses a local Ollama model for fully offline validation.

validation:
  mode: "kernel"

kernel:
  url: "http://localhost:11434/v1"
  model: "llama3"

Requires Ollama running locally. Best for air-gapped environments or when you need zero external API calls.

Operating modes

Separate from validation mode, Veto has two operating modes:

mode: "strict"  # or "log"

Use log mode during initial rollout to observe what would be blocked without affecting agent behavior.