Use Cases/Enterprise Agents

Enterprise AI governance starts where SSO ends.

SSO, SCIM, and RBAC establish identity. Enterprise AI governance still needs tool-call authorization. Which tenant data may this agent read? Which workflow may it change? Which deployment may it trigger? Which high-risk action needs approval? Veto provides agent tool-call controls and decision records tied to enforcement before execution.

Enterprise AI agent security defined

Enterprise AI governance is runtime control over what authenticated agents may do across tenants, systems, and regulated workflows. Veto can enforce workflow-specific AI risk controls before execution and record AI agent decision records for SOC 2, GDPR, EU enterprise AI evidence, and security review evidence.

The enterprise threat landscape

Enterprise agents fail at the boundary between valid access and unauthorized action. A valid account can still approve the wrong payment, expose tenant data, rewrite a customer record, or trigger a workflow no security review approved. Shadow AI makes that worse: teams release agents with ad-hoc permissions and no central decision record.

Cross-tenant data leakage

An agent authorized for Tenant A accesses Tenant B's data. In multi-tenant SaaS, this is a material failure: a single cross-tenant leak can trigger breach notification obligations across every affected customer.

Shadow AI proliferation

Without centralized authorization, teams deploy AI agents with ad-hoc permissions that no security review has approved. The risk is not only what the model says, but which tools it can invoke.

Decision record gaps

Traditional logging captures API calls but not the authorization decision recordic. Without knowing why an action was allowed, which policy matched, and what context was evaluated, auditors see the action, not the control that permitted it.

Scale without control

Dozens of agent types, hundreds of instances, thousands of daily decisions. Manual oversight does not scale. You need automated enforcement with human escalation for the actions that matter.

How Veto maps to SOC 2 Type II trust service criteria

SOC 2 Type II evaluates five trust service criteria. For B2B AI agents, SOC 2 Type II is a deal requirement for contracts over $50,000. Here is how Veto provides evidence for each criterion.

Trust Service CriteriaVeto Implementation
Security (CC6, CC7, CC8)Policy-as-code access control, per-agent credentials, encrypted storage, decision records with export paths
Availability (A1)In-process policy evaluation on the local core path, graceful degradation on service interruption, health monitoring
Processing Integrity (PI1)Deterministic policy evaluation: same input produces the same decision. Decision records carry the inputs, policy version, outcome, and verifier
Confidentiality (C1)Tenant isolation at the policy layer, field-level access control, data classification enforcement, redaction policies
Privacy (P1-P8)Purpose limitation enforcement, data minimization policies, right-to-erasure support, processing activity logs for GDPR Article 30

Multi-tenant isolation policy

A policy file that enforces tenant isolation, role-based access, and approval workflows. This is the pattern enterprise SaaS platforms deploy with Veto.

veto-policy.yaml
name: enterprise-multi-tenant
description: Tenant isolation, RBAC, and approval workflows

rules:
  # Hard tenant boundary: enforced on each governed tool call
  - name: tenant-isolation
    tools: ["*"]
    condition: "args.tenant_id != context.tenant_id"
    action: deny
    response:
      error: "Cross-tenant access blocked"
    audit:
      log_arguments: true
      alert_on_deny: true

  # Role-based database access
  - name: database-read-roles
    tools: ["database.query", "database.export"]
    condition: "context.user_role not in ['analyst', 'admin']"
    action: deny
    response:
      error: "Role not authorized for database access"

  # Approval workflow for bulk operations
  - name: bulk-operations-approval
    tools: ["database.bulk_update", "database.bulk_delete"]
    condition: "args.count > 100"
    action: require_approval
    constraints:
      approver_role: "data-steward"
      timeout: "4h"
    response:
      message: "Bulk operation affecting 100+ records requires approval"

  # Payment limits by role
  - name: payment-limits-admin
    tools: ["payment.initiate"]
    condition: "context.user_role == 'admin' and args.amount > 100000"
    action: require_approval
    constraints:
      approver_role: "finance-manager"
    response:
      message: "Payment exceeds admin limit of $100,000"

  - name: payment-limits-support
    tools: ["payment.initiate"]
    condition: "context.user_role == 'support' and args.amount > 1000"
    action: deny
    response:
      error: "Support role limited to refunds under $1,000"

  # PII access requires purpose declaration
  - name: pii-purpose-limitation
    tools: ["customer.read_pii", "customer.export"]
    condition: "context.purpose not in ['support_ticket', 'billing', 'legal_hold']"
    action: deny
    response:
      error: "PII access requires declared purpose"

  # Configuration changes require approval
  - name: config-change-approval
    tools: ["config.update", "permissions.modify", "api_key.rotate"]
    action: require_approval
    constraints:
      approver_role: "platform-admin"
    response:
      message: "Configuration changes require platform admin approval"

Policies are version-controlled and deployed through your CI/CD pipeline. Every change is tracked. Each governed decision is recorded. Auditors get the decision record instead of a reconstructed story.

Enterprise deployment patterns

SSO integration with identity-aware policies

Pass SSO context from your IdP (Okta, Microsoft Entra ID, Google Workspace). Policies use authorization context from the user who initiated them. Policies reference group membership, department, and custom attributes from your IdP. When a user leaves the org, their agent permissions are revoked at the policy layer.

Role-based agent permissions

A finance agent initiates payments up to a threshold. A reporting agent gets read-only database access. A customer success agent views accounts but cannot modify billing. One policy file defines all role boundaries. Changes can deploy with the rest of your application release path.

Multi-tenant isolation

Per-tenant policy scoping constrains agents to data within their tenant context. A customer support agent for Tenant A cannot query Tenant B's tickets, even on shared infrastructure. The policy layer gives reviewers a second control point beyond application-layer checks.

Human review for review-required actions

Route high-risk actions to human reviewers before execution. Batch uploads, permission changes, data exports, and configuration modifications trigger approval workflows. Approvers see the decision context: what, why, and which policy flagged it.

Veto vs DIY for enterprise

CapabilityBuild in-houseVeto
Policy engine with YAML config
Multi-tenant isolation
SSO integration (SAML, OIDC)
Role-based access control
Human approval workflows
Decision records
SOC 2 evidence reporting
GDPR processing activity logs
Review queue & records
Framework integrations
Rollout shapePlatform buildFirst governed workflow
Engineering maintenanceOngoingProduct-owned updates

Related enterprise use cases

Frequently asked questions

How does Veto integrate with enterprise SSO?
Veto can evaluate the identity attributes your app passes from an IdP such as Okta, Microsoft Entra ID, Google Workspace, or OneLogin. Authorization context can include user identity, group membership, and custom attributes. Policies reference those attributes on the governed tool call; keep the IdP sync path in your integration.
Can Veto enforce multi-tenant isolation?
Yes. Each governed tool call includes tenant context that policies evaluate before execution. This adds an authorization check on the governed path: even if application-level isolation is misconfigured, the policy can deny cross-tenant access before the governed call executes. Denied cross-tenant attempts are recorded with decision context for incident review.
What audit capabilities does Veto provide for SOC 2?
Each governed authorization decision is recorded with tool name, arguments, policy matched, outcome (allow, deny, or approval), timestamp, user context, and tenant ID. Decision records are designed for workspace inspection, export, and SIEM forwarding where configured. Those decision records can be mapped to SOC 2 trust service criteria for Security (CC6-CC8), Processing Integrity (PI1), and Confidentiality (C1).
How do approval workflows work for enterprise deployments?
Policies route specific actions to human approval queues based on configurable criteria: amount thresholds, record counts, data sensitivity, or role boundaries. Approvers review the decision context: what, why, and which policy flagged it. The approval or denial is recorded with reviewer rationale.
What is the latency impact of policy evaluation?
Core policy evaluation can happen on the local in-process decision path. Approval workflows that require human review introduce intentional latency. That is the point. Auto-approved calls stay on the local decision path.

Enterprise authorization for AI agents. Bring tool-call evidence to the security review.