Identity that stays attached inside inference.
IAM tells you who an agent is. Vervain keeps that identity attached to the data inside inference.
When an AI agent answers a question, a database row becomes a retrieved chunk and then part of the model's prompt, and the identity of its owner falls off along the way. One missing tenant filter can put one customer's private note into another customer's request. Vervain checks every retrieved chunk against the session that asked for it and withholds foreign context before the model is called. It checks the policy again before the answer is released, and each run leaves a hash-chained receipt that records the decisions without storing the protected text.
Built with Gemini 4 Carbon in Antigravity CLI
What the live demo shows
Tenant Alder asks Gemini 4 Carbon to summarize its Northstar renewal. A deliberate missing tenant filter also retrieves Tenant Beacon's private note, which carries a hidden override instruction. The same request runs twice.
Vervain off
2 of 2 chunks enter the Gemini request.
Beacon's private note goes to the model alongside Alder's renewal playbook.
Vervain on
1 of 2 admitted, 0 foreign bytes sent.
Beacon's note is withheld before the Gemini call. The policy is checked again at release, Alder still gets its answer, and a hash-chained receipt records what happened without storing the content.
Scope: Vervain mediates this app's own context and reply paths. Gemini's internal KV cache is not mediated, and the tenant picker is a demo fixture, not an enterprise login.