FAQ
The questions a first review actually asks
Engineering, risk and compliance, in the order they come up. Short answers so a reviewer can get their bearings; bring the edge cases to a working session.
Is this guardrails?
No. Guardrails screen what a model says, and observability reports what already happened. Verdict decides whether a proposed action executes at all, before it runs, and leaves a signed record of the decision. If you already run content filtering, keep it. The two do different jobs and we compose with yours.
Another gateway in my hot path?
It is a check, not a hop through a third party. Rego is evaluated in-process against a policy bundle already in memory: single-digit milliseconds in our measurements, under 15 ms as the ceiling we hold. No model is called, so there is no inference latency and no prompt leaving your boundary.
Why not just run OPA ourselves?
You can. Evaluating a rule is the straightforward half. OPA on its own does not give you entity-keyed running state, obligations that execute mid-action, figures bound to a source the model cannot author, or a signed chain that stays checkable when the policy changes. Verdict is those around an OPA core.
Does compliance have to write code?
No. Upload the SOP, or describe a rule in English. Verdict drafts each clause against the tools you have registered, then compiles, schema-checks and fuzzes it. Nothing activates unreviewed: a clause with no mapping is flagged, not guessed.
How do we know a new rule will not break production?
Before a drafted rule is activated, Verdict replays it against your recorded decisions and reports what would have changed over the last thirty days. Conflicts with rules already in the bundle are surfaced at the same time.
Do you replace our GRC platform or identity provider?
No. Your identity provider still says who is acting; Verdict enforces what that principal may do and records it. Your GRC platform still holds the control library; Verdict produces the evidence that a control actually ran. It is a layer, not a platform play.
Can we shadow-mode first?
Yes, and we recommend it. Verdict logs what it would have allowed, blocked or repaired on live traffic while changing nothing. Your risk owners see real decisions on real volume before a customer is affected, and enforcement turns on per policy rather than all at once.
How do we support audit and regulatory review?
Every decision exports as an evidence pack: one file, JSON or a one-page report, with the hash chain verified inside it, readable end to end without engineering. Each record is pinned to the policy version that made the decision. Your counsel sets the bar; we supply the artifacts.
Do we have to replace our agent framework?
No. Verdict is framework-agnostic and model-agnostic. You integrate at the tool-call boundary, or in front of an MCP server, or through a gateway you already run. Orchestration stays yours.
What if we do not have an agent yet?
We co-build one bounded workflow with you on the same product you can try in the playground, so policy and evidence are one model from the first line of code rather than retrofitted later.
What happens if Verdict is unreachable?
A single Go binary in your VPC, with no outbound call in the decision path, so no third party can take it down. What the agent does if the gateway does not answer is yours to set at the integration point, and it is one of the first things we work through.
How does this relate to the EU AI Act or internal model risk?
High-impact automation needs accountable controls: oversight where required, technical documentation, and traceability from a decision back to the policy that made it. Verdict supplies pre-execution outcomes, versioned policy and inspectable evidence. Legal interpretation stays with your counsel.
Your question not here?
Bring it to 30 minutes on the live product, or try the playground first and come back with specifics.