The mechanism, then the mapping

How Levee works

The operating system enforces the boundary. A service the model cannot reach enforces the policy. The trail is written before each action completes.

The mechanism

Levee puts a kernel-enforced boundary around each AI agent on the Windows workstation. Every network call the agent makes passes through a governed proxy: it checks policy, logs the request, and either permits or blocks it.

The container

Levee runs the AI agent inside a Windows Container using process isolation. The container is a kernel-enforced security boundary. Process isolation, filesystem restrictions, and network blocking are all enforced by the OS kernel, not by the model or application layer. No Hyper-V is required; Levee runs on Windows 11 Pro, Enterprise, and Education. If the agent is compromised by a prompt injection attack, it cannot reach what was not explicitly granted.

The governed proxies

All agent network traffic flows through Levee's governance proxy, which governs seven categories of access:

Access channel	What the proxy controls
Web	Approved URLs and HTTP methods; all others blocked
LLM APIs	Permitted model endpoints; requests logged before dispatch
Databases	Read vs. write permissions per connection; deeper SQL inspection on the roadmap
Package registries	Approved registries; version ranges optionally constrained
Files	Read-only or read-write per path; drag-and-drop grant model
Search	Approved search endpoints
Office	Office operations mediated through the proxy

Every channel is deny-default and fail-closed. Deny-default means no access is permitted unless the policy explicitly grants it. Fail-closed means that when policy is ambiguous or the proxy cannot determine whether a request is permitted, access stops. The agent waits; it does not proceed on a guess.

Deny-default, SYSTEM-enforced

Policy is set by an administrator and enforced by a SYSTEM-privilege Windows service. The agent process runs at a lower privilege level and has no path to modify or bypass the policy. A prompt-injected agent that tries to reach a resource not in the allowlist receives a denial at the proxy layer before the request leaves the workstation.

The audit trail

Every request the agent makes, every approval, and every denial writes to the audit trail before the action completes. The record precedes the action. Levee writes the audit entry at the proxy layer, not by asking the agent to self-report. The trail answers: which agent, which resource, which action, which policy, which session, and at what time.

Illustrative artifacts

What Levee produces

These examples show the format and content of Levee outputs. They are illustrative and do not represent a real session.

Policy snippet

# Illustrative policy (not a real session)
policy: agent-sandbox-v2
default: deny
rules:
  - resource: "https://api.anthropic.com/v1/*"
    methods: [POST]
    action: allow
  - resource: "db://prod-finance/*"
    action: deny
  - resource: "file://C:/Projects/myapp/**"
    methods: [read, write]
    action: allow
  - resource: "office://sharepoint/Finance-Reports/**"
    methods: [read]
    action: allow
  - resource: "https://registry.npmjs.org/*"
    methods: [GET]
    action: allow

Audit log entryDENIED

2026-03-11T14:32:07Z  agent=claude-code  action=DENIED
  resource=db://prod-finance/orders  policy=agent-sandbox-v2
  reason=resource_not_in_allowlist  session=ws-0042

Denial in practice

The agent attempts to read a production database connection string outside its approved file path. The proxy intercepts the request, checks the policy, finds no matching allow rule, and writes a DENIED record to the trail. The agent receives an access-denied response and reads nothing. The record is in the trail before its next instruction runs.

Scope, stated plainly

Levee runs on Windows 11 Pro, Enterprise, and Education. No Hyper-V required. Levee is in preview: available to design partners now and not in general release. Current capabilities are the kernel-enforced container sandbox, the governance proxy with deny-default policy, and the immutable audit trail. Deeper SQL inspection and additional connectors are on the roadmap.

Compliance and evidence

An auditor, a regulator, or a risk committee asks for a specific control, tied to a specific obligation, with evidence. Each regulation below carries all three, and a note on what it does not cover.

MiFID II

Obligation: Investment firms operating in EU member states must retain records sufficient to reconstruct the orders and transactions they executed. Records must capture what happened, when, and by whom. Where automated tools contribute to that process, firms need records of what those tools did. An agent that queries a pricing database, reads a position file, or calls a market data API is touching systems that MiFID II governs.
Levee control: The immutable audit trail records every agent request against covered systems before the request completes. The trail captures the agent identifier, the resource requested, the action taken, the policy applied, and the timestamp. The record cannot be altered after the fact.
Evidence produced: A time-ordered log of every agent interaction with financial systems, including denials. Sufficient to reconstruct agent activity over any period. Exportable for regulatory submission.

What this does not cover

Levee addresses the records-retention and access-control dimension of MiFID II obligations. Legal and compliance counsel should confirm how Levee's trail maps to the specific obligations of the firm's regulatory perimeter. Levee does not make a firm “MiFID II compliant” as a blanket claim.

SOX Section 404

Obligation: Under SOX Section 404, management must assess and attest to the effectiveness of internal controls over financial reporting. Auditors independently assess those controls. Controls must be documented and demonstrable, not asserted. Where AI agents operate against financial reporting systems, the controls over those agents are part of the Section 404 scope.
Levee control: The governed proxy enforces deny-default access to financial systems. No agent can reach a financial database, a reporting pipeline, or a file store containing financial records unless the policy explicitly permits it. Every permitted and denied attempt is logged with policy reference, timestamp, and session identifier.
Evidence produced: An access log pairing each agent request against a financial system with the policy state at the time of that request. An internal audit team can pull the log for any session, any date range, and any resource to substantiate the control claim.

What this does not cover

SOX Section 404 controls extend across financial processes well beyond AI agent access. Levee addresses the agent-access control dimension. It does not certify the broader SOX compliance posture of the firm.

DORA

Obligation: The Digital Operational Resilience Act requires financial entities operating in the EU to manage ICT risk, maintain controls over the ICT systems they use, and produce evidence of those controls for supervisory review. A firm that cannot say what an agent accessed, what it was blocked from accessing, and what policy governed it has a gap in its ICT risk documentation.
Levee control: The kernel-enforced container restricts what ICT resources the agent can reach at all. The deny-default proxy enforces the permitted set. The audit trail documents every access and every denial, with the policy version applied.
Evidence produced: A record of what each agent could reach (the policy), what it requested, and what was permitted or denied. Sufficient to answer supervisory questions about ICT access controls during any period covered by the trail. Supports the firm's ICT risk register entry for AI agent tooling.

What this does not cover

DORA's scope covers ICT risk management, third-party provider oversight, incident reporting, and resilience testing. Levee addresses the access-control and audit evidence dimension. It does not constitute a complete DORA compliance programme.

Audit as evidence: the principle

An auditor does not take your word that controls exist. An auditor tests them. Levee's trail is written at the enforcement layer, before the action completes, by a SYSTEM service the agent cannot modify. It is not a self-report.

A log the agent could have written is weaker evidence than a log the agent cannot reach. Levee's audit trail is the second kind.

Swiss data sovereignty

Vediram is incorporated in Lausanne, Switzerland. Levee processes agent traffic on the local workstation. No agent traffic is routed through Levee servers. The European Commission recognises Switzerland as providing an adequate level of data protection, which matters for EU buyers evaluating data-residency requirements. The audit trail is stored locally; export and retention are under your control.

SOC 2

Levee makes no SOC 2 claim today. Any SOC 2 report will be shared with design partners when an issued report exists.

A note on compliance claims

No software product makes an enterprise compliant with MiFID II, SOX, or DORA by itself. Compliance is a posture the organisation holds. Levee supplies specific controls, specific evidence, and a specific audit trail that support the posture your legal and compliance team maintains.

Bring this to your security team.

Levee is in preview and not yet generally available. We are onboarding design partners now.

Request access