Veto (PlawIO/veto) is an Apache-2.0 authorization layer that wraps an agent's tools and returns allow, deny, warn, or require-approval verdicts from deterministic YAML rules before the tool handler runs, with a commercial Veto Cloud for shared approvals and records.

**Its thesis is that authentication says who the agent is and sandboxing says where it runs, but neither answers whether this specific action should execute, so Veto inserts the missing authorization gate between intent and side effect and records a tamper-evident receipt for each decision.**

## What it is

`protect(tools)` in TypeScript or `pip install veto` in Python wraps a tool set; Veto loads `./veto/veto.config.yaml` and `./veto/rules/*.yaml` if present and otherwise applies observe-mode safe defaults so suspicious shell, file, database, and money patterns are logged rather than silently blocked.
Rules support actions `block`, `allow`, `warn`, `log`, and `require_approval`, and the README publishes a runtime adapter matrix covering the Vercel AI SDK, OpenAI Agents, LangChain and LangGraph, MCP, Browser Use, OpenClaw, Claude SDK, Google ADK, Mastra, AutoGen, and CrewAI.
Policy can be authored in plain English and compiled to reviewed YAML, but the LLM drafting step is explicitly outside the authority path; decisions are deterministic.
Everything runs local-first, including a self-hostable evaluation server and an offline-verifiable `veto.receipt/1` chain, and BYOC deployments keep policy and decision rows in the customer plane.
It is made by Plaw, Inc. (US), which lists Veto as an EU AI Pact signatory.

## Status

Active product, thin open-source community.
The repository was created 2026-01-02 and sits at 14 stars, 2 forks, and 1 open issue as of 2026-09-27, last pushed 2026-06-18, with the latest published SDK release `veto-sdk@2.9.3` on 2026-05-07.
The website, docs, and pricing pages are current and extensive, and the company markets to agent vendors and regulated buyers, so the commercial product is clearly live.
**The public footprint is small: a Hacker News search for Veto returns nothing relevant, and the starred count is in the low tens, so adoption evidence comes from the product surfaces rather than the community.**
One operational wrinkle the README states plainly: Plaw does not yet control the unscoped `veto` npm name, so installs use the `veto-cli` package form until the transfer completes.

## Strengths

- Deterministic local evaluation by default, with no account, API key, or network needed for the core decision.
- Approval is bound to the exact action hash and policy hash, so a mismatched approval fails closed rather than rubber-stamping a different call.
- Offline-verifiable decision receipts and a published benchmark (p99 in microseconds for local single-rule and merged-pack evaluation) make the audit story concrete.
- Broad framework coverage and two SDKs mean the gate is one wrapper call, not a rewrite.

## Cautions

- The open-source project is small (14 stars) and the last source push predates the latest docs, so treat the community as nascent and the company as the real support channel.
- The free tier caps at 5,000 checks per month with a hard stop, and hosted pricing scales by checks, so a high-volume internal agent can move from free to several hundred dollars quickly.
- The README notes the unscoped `veto` npm name is not yet controlled by Plaw, which is a supply-chain detail to watch.
- Benchmarks are self-published and the comparison against another toolkit uses that toolkit's own published numbers, not a reproduced head-to-head.

## Pricing

Developer is $0 per month with 5,000 action checks, 7 days of decision records, and no credit card; the Apache-2.0 local engine is included.
Hosted is $299 per month for 100,000 checks, $0.75 per 1,000 checks above plan, 90 days of records, and unlimited seats and reviewers.
Enterprise is custom, covering cloud, BYOC, on-prem, or isolated networks with HIPAA BAA, SSO, SCIM, and SLAs.

## Price history

| Date | Plan | Change | Source |
| ---- | ---- | ------ | ------ |
| 2026-09-27 | Developer | Introduced at $0/month, 5,000 checks, hard cap | https://veto.so/pricing |
| 2026-09-27 | Hosted | Introduced at $299/month, 100K checks, $0.75 per 1K overage | https://veto.so/pricing |

## Compared to

- [Microsoft Agent Governance Toolkit](../microsoft-agent-governance-toolkit/index.md): a broad multi-language governance program; choose AGT for identity, sandboxing, and compliance across stacks, and Veto for a single deterministic gate with portable receipts.
- [Code Atelier Governance SDK](../code-atelier-governance-sdk/index.md): a Python and Postgres SDK with HITL gates and an HMAC audit chain; choose it when your stack is Python and Postgres, and Veto when you want framework-agnostic wrapping and a hosted approval inbox.
- [SettleBridge](../settlebridge/index.md): trust and settlement for agent-to-agent commerce; a different layer, since Veto authorizes a tool call while SettleBridge settles an economic obligation.

## Bottom line

**Recommended for teams that put money, data, or customer-facing actions behind a deterministic pre-execution gate with approval routing and verifiable receipts. Not for teams that need a full org control plane with budgets and chain of command, or that require a large open-source community before adopting.**

## Changes

- 2026-09-27 - Created.

## See also

- [Control Planes Feature Matrix](../control-planes-feature-matrix/index.md) - the category compared on shared rows
- [Microsoft Agent Governance Toolkit](../microsoft-agent-governance-toolkit/index.md) - the broad, vendor-backed alternative
- [Code Atelier Governance SDK](../code-atelier-governance-sdk/index.md) - the Postgres-only Python alternative
- [SettleBridge](../settlebridge/index.md) - the settlement-layer neighbor
- [An Agent Is Only as Safe as Its Worst Tool Call](../../../an-agent-is-only-as-safe-as-its-worst-tool-call/index.md) - why the interception point is the right place to enforce

## References

- https://veto.so/ - product framing, supported frameworks, EU AI Pact claim
- https://veto.so/pricing - Developer, Hosted, and Enterprise plans with dollar amounts
- https://github.com/PlawIO/veto - README: `protect()`, rules, adapter matrix, benchmarks, BYOC boundary
- https://api.github.com/repos/PlawIO/veto - stars, forks, issues, push dates as of 2026-09-27
- https://docs.veto.so - documentation: MAP artifacts, local runtime, receipts, adapters
- https://api.github.com/repos/PlawIO/veto/releases - veto-sdk@2.9.3, 2026-05-07