Under the hood
For the engineer who has to approve it
What Virca may run, and who decided it
The boundary
For the engineer who has to approve it
Approved once means approved — not unsupervised.
Letting AI near production is the part that has to be right, so the approving happens before anything runs, not in the middle of an incident. Your engineer names the commands, AI writes when they run and in what order, and your team reads it back — the exact commands, the hosts they may touch — and signs it. Nothing is live until they do. After that the agent runs inside that line and only that line, and anything outside it still stops and asks. Recommend → approve → act: your team decides the set, and the agent never runs past it. Think cruise control, not self-driving: you set the direction, it holds the line, and you take the wheel the moment you want to.
The three questions a security review asks, answered at length
What can it touch? The action language has no shell escape, so the list of Builtin Functions an ActionBook calls is the exact extent of what it can touch. There is no general-purpose command underneath to fall back to. A reviewer can read that list before anything runs, which makes it something to say yes to rather than take on trust. Each action is bound to the targets you assign, so its reach also stops at the hosts you named. The functions your engineers write for their own environment stay in your workspace; they do not flow back to us.
What credentials does it hold? None of yours on our side. Credentials stay on your hosts and never sit on our servers. The Agent opens one outbound connection to Virca, and nothing listens for inbound traffic — no port to open, no inbound path to review. The Agent works on the host it was installed on, and that host is also the limit of what it can see.
And if it makes things worse? Every action carries a grade, set by reversibility before anything executes. On the AI path that grade decides what happens, on the server, before the Agent is told anything — so a refusal never reaches the host. Routine actions run on the host inside the approved set. Ones needing a second look wait for one tap in team chat, with the reasoning attached. Anything graded irreversible is refused outright. A rule-bound action was approved when your team armed the rule, and your workspace can switch the same gate on for that path too. After a run, the confirm step re-checks the target and calls the reverse steps where one exists.
Your engineer names it, AI orders it, your team signs it
Your engineer names the commands and the hosts they may touch. AI writes when they run and in what order. Your team reads it back and approves it. Neither half works alone — and that one pass in daylight is why it is safe to leave running at night.
One-tap approval
Anything outside the approved set stops. It reaches your team chat with the reasoning attached, and one tap answers it.
Audit log
Every execution records who or what triggered it, what ran, on which host, and what happened after.
Scoped to the hosts you assign
Each action is bound to the targets you assign. Every approval goes on the record with the identity of whoever answered it.
a request
AI-driven — graded by reversibility, on the server
runs on the host
inside the approved set
one tap in team chat
reasoning attached
refused outright
no route around it
Credentials stay on your hosts — never on our servers. The functions your engineers write stay in your workspace too; they do not flow back to us. The Agent is installed per host, so the machines any of this can reach are exactly the ones you rolled it out to. How the connection is built, end to end →
The guardrail
For the person who owns the headcount
Recommend → approve → act. Nothing skips the middle one.
Those three words sit in that order on purpose, and no mode drops the middle one — not for a severe event, not at 3am, not because the draft looks obvious. An approved action buys one narrow thing, and it is worth saying plainly — it runs without waking anyone. It does not run unsupervised. Your team gave a real approval, in advance, with the exact commands and hosts on screen. That approval set the line; it did not hand over the wheel. Outside that line the agent stops and comes to your team, and the functions that carry real risk ask again at the moment they run.
- 1Recommend
- 2Approve
- 3Act