Varendo

Safety infrastructure

Make invalid, stale, unauthorized, and over-budget proposals non-executable while keeping limitations visible.

Varendo's safety claim is structural. The runtime rejects proposals that violate registered contracts or current authority. It does not promise that a language model always understands the user.

Follow the non-bypassable pipeline

  1. 1

    Parse

    Treat every ingress as unknown and validate a bounded intent schema.

  2. 2

    Authorize

    Read principal, scope, policy, grants, and limits from the trusted host.

  3. 3

    Compile and evaluate

    Use only registered fields, meanings, functions, operations, and data services.

  4. 4

    Present

    Select only registered recipes and views compatible with the Result and Experience.

  5. 5

    Recheck and commit

    Reject stale read sets or revoked authority before replacing the Region.

Watch a proposal fail

No caller can smuggle authority or markup inside an intent. The schema allows only the declared envelope fields, so this request fails during parsing — before any data is read:

Rejected intent

JSON example
{
  "version": "1",
  "id": "show-everything",
  "kind": "browse",
  "resource": "people",
  "principal": "admin",
  "html": "<script>…</script>"
}

The caller receives a bounded wire.unrecognized_keys diagnostic naming the undeclared fields. The previous committed view stays in place.

Expect these rejections

  • Unknown resource, field, action, view, meaning, or function.
  • Principal, grants, credentials, executable code, HTML, JavaScript, SQL, network endpoint, or import path from an agent.
  • Cross-session or cross-Region invocation.
  • Stale Catalog, Result, source, policy, entity, or presentation revision.
  • Payload or loop that exceeds configured limits.
  • Agent-created confirmation for a protected action.

Limit data egress

Context discovery sends only allowed metadata by default. Records or detailed Results leave the application for a model only when a separate host egress policy allows it. Prompt injection inside records cannot add grants or install code.

Read receipts honestly

“Renderer ready” means the runtime evidence committed and the renderer accepted the plan. It does not prove pixels were painted or that the user noticed them. Numeric claims shown by the app come from Result evidence; arbitrary model prose remains prose.