FAQ

Answers to the questions people ask most about Vediram Levee: what it does, requirements, deployment, security, data, compliance, and daily use

About Levee

What is Levee, in one sentence?

Levee runs an AI agent on a Windows computer inside a sandbox for each project, sends everything the agent reaches through channels your policy controls, keeps real passwords and keys out of the agent's reach, and records every decision in an audit trail.

What problem does it solve?

An AI agent normally works with your own access: it can read any file you can, reach any system you can, and follow instructions hidden in what it reads (prompt injection). Levee puts limits around the agent that the agent cannot change, and records what happened, so the agent can work on real files and data within rules your organization sets.

Which AI agents does Levee support?

Claude Code, Codex CLI, and GitHub Copilot CLI. All three run in a project's terminal. The Easy mode chat supports Claude Code and Codex CLI. Your administrator decides which tools, and which versions, are available. See AI tools.

Can we add another agent or tool?

Agents reach Levee as verified tool packages. Contact Vediram through support to ask about one that isn't available yet. Your organization can also give the agent extra tools through plugins (Preview).

Is Levee an agent, or does it replace our agent?

Neither. Levee has no AI of its own. People keep using the AI tools they already know; Levee is the controlled place those tools run in.

Requirements

Which Windows versions are supported?

Windows 11 Pro, Enterprise, or Education, version 22H2 (build 22621) or later, on 64-bit (x64) PCs. See System requirements.

Why isn't Windows 11 Home supported?

Levee's sandboxes are Windows containers, and Windows containers aren't available on Home editions.

Is Windows 10 or Windows Server supported?

No. Levee requires Windows 11 Pro, Enterprise, or Education.

Does Levee need Hyper-V or virtualization turned on?

No. Levee uses process-isolated Windows containers, which don't need Hyper-V, nested virtualization, or VT-x. It needs the Windows Containers feature, which the Levee app can turn on for you (administrator rights and a restart required).

Does it work on virtual desktops (VDI)?

Yes, because it doesn't need a hypervisor inside the desktop. It runs on single-session Windows 11 Pro, Enterprise, or Education virtual desktops, such as Windows 365 Cloud PCs and personal Azure Virtual Desktop, Citrix, or VMware Horizon desktops. Multi-session Windows editions are not supported.

How much memory and disk does it need?

At least 8 GB of memory (16 GB recommended) and 30 GB of free space on the system drive. The sandbox image is several gigabytes, and Levee keeps 20 GB of headroom free by default when it downloads one. A running sandbox uses a few hundred megabytes of memory plus whatever the agent's work needs, capped at 4 GB by default (configurable).

We already use Docker Desktop. Will Levee conflict with it?

No. Levee ships its own container engine, runs it as its own Windows service, and does not use, change, or depend on Docker Desktop or any other container software on the computer.

Does Levee use Linux containers or WSL?

No. Sandboxes are Windows containers, and agents run as normal Windows programs. The standard sandbox includes PowerShell 7, Git, Python, and Node.js.

Do users need administrator rights?

No. Only installing Levee and preparing the computer need administrator rights, which IT normally does during deployment. Everyday use (creating projects, sharing files, running agents, answering approvals, reading the audit log) works as a standard user.

Deployment and administration

How do we deploy Levee to many computers?

Levee is a single MSI that installs silently, so you deploy it with Intune, Configuration Manager, or whatever endpoint tooling you already use. The computer needs the .NET 8 runtimes and the Windows Containers feature first. The installer adds the rest, including LeveeFS, the component that shows shared files inside the sandbox. See Installation and Enterprise deployment.

How do we manage policy centrally?

Enroll computers with your Vediram tenant and write the policy in the Vediram Portal. Every enrolled computer downloads it when the Levee app starts and every five minutes after, and enforces it locally. You can also deploy a policy.json file with your own tooling. See How policy works.

What happens if a computer can't reach Vediram Cloud?

It keeps enforcing the last policy it received. A failed or partial download never replaces a working policy.

Can Levee run fully offline or in an air-gapped network?

Yes. Stage the sandbox image on the computer instead of downloading it, deploy policy as a local file, and point runtime downloads at an internal mirror if you have one. The agent still needs to reach the AI model provider you've approved. See Container runtime, offline, and air-gapped.

Does Levee update itself?

The Levee programs update when you deploy a newer MSI. Levee never replaces the sandbox image on its own: it shows that an update is available, and the update is applied when you choose. AI tool versions are fixed per project and only change when a user approves an upgrade.

Which antivirus exclusions are needed?

One: exclude %ProgramData%\Vediram\Levee\engine\data from real-time scanning. Keep scanning project folders. See Files and locations.

Does it work behind our corporate web proxy?

Yes. Levee's web channel uses the computer's proxy settings, including PAC files, for the agent's approved traffic. The upstream proxy must accept connections from the computer without an interactive sign-in.

Does it work with our VPN?

Usually. Some VPN clients that force all traffic through the tunnel also capture the local network Windows uses for containers, which stops sandboxes from reaching Levee. If projects can't reach anything while the VPN is connected, ask your VPN administrator to exclude the local container network from forced tunneling.

Can several people use Levee on the same computer?

Yes. Each Windows user has their own project folder and projects, and sees only their own projects' activity and approvals. Only one project can run on the computer at a time, though. While another user's project is running, Levee says Another user's project is running on this computer. Try again once it has stopped.

Security

Can the agent see our API keys, database passwords, or session cookies?

No. The agent receives a placeholder model key that only works through Levee, a database alias instead of a connection string, and no cookies. The real credentials stay outside the sandbox. See Security model.

Can the agent bypass Levee and connect directly to the internet?

No. The sandbox has no direct network access. Windows blocks any traffic from the sandbox that doesn't go to a Levee channel, including programs that ignore proxy settings, and a project won't start if that block can't be put in place.

Can the agent reach our internal network?

Not over the web channel: website names that point to private or internal addresses are always refused. Internal databases are reachable only through database access, with the aliases, query types, and tables your policy grants.

Can the agent read files outside its project?

Only the files and folders you share with that project. You share them from the project's Access Policy tab, read-only or read and write, and the agent finds them under L:\ inside the sandbox. Anything you haven't shared doesn't exist for the agent. See File access.

Why does the agent just say "Access denied" without a reason?

On purpose. Every refusal looks the same to the agent, so an agent that has been tricked can't probe your policy. The reason is in the audit trail; see Agent gets "Access denied.".

What happens if the Levee service stops or crashes?

Windows restarts it automatically. While a channel can't reach the service, it stops approving requests, and it switches to deny-all if the connection isn't restored within a short grace period. Projects can't start without the service.

Who can read or change the audit trail?

Standard users can read it, but they and the agent can't change it: only the Levee service can write to it, and standard users are explicitly denied write and delete. Local administrators can delete the files, so forward the audit trail to your SIEM (central security logging) or to Vediram Cloud as it is written if you need evidence that survives the computer. See Activity and audit.

What if the audit trail can't be written?

Audit records are written asynchronously: the action does not wait for its record to be stored. If the audit store fails, Levee raises a SecurityAuditWriteFailed alert, but the alert does not stop the action or recover the missing records, so a failure can leave gaps in the trail. Forward the audit trail off the computer, and alert on SecurityAuditWriteFailed in your SIEM or in Vediram Cloud, so you know when the local record may be incomplete.

Is a Windows container a strong enough boundary?

Levee doesn't rely on the container alone. Process-isolated containers share the computer's Windows kernel, and Microsoft doesn't service them as a security boundary. Levee's controls are the network block around the sandbox, the governed channels, and keeping credentials out. Reviewers should read Security model, including its limits section.

Does Levee inspect encrypted traffic?

Only for websites where your policy turns inspection on, or where a rule limits the allowed methods. Otherwise Levee controls HTTPS connections by destination website without decrypting them.

Data and privacy

Does agent traffic go through Vediram servers?

No. Levee enforces policy on the computer. Model calls go directly to the provider you configure, unless you choose to use the Vediram LLM Gateway. Web searches go to the search provider you choose.

Does Vediram see our files, prompts, or data?

Not through Levee. Your files stay on the computer, and prompts go to the model provider you configure. If you turn on audit forwarding to Vediram Cloud, governance events (requests and decisions, including resources such as website names, SQL text, and search queries) are sent to your tenant; prompts and responses never are.

What does the audit trail record that might be sensitive?

The SQL text of database queries (cut to 500 characters) and the full text of web searches, along with website names, file paths, and model names. Treat the audit trail with the same care as other security logs. See Audit event reference.

Where is Vediram based?

Vediram is a Swiss company based in Lausanne, Switzerland.

Compliance

Does Levee make us compliant with MiFID II, SOX, or DORA?

No product makes a firm compliant on its own. Levee provides access controls over AI agents and a time-ordered audit trail of every request and decision, which support the record-keeping and access-control parts of those obligations. Your compliance and legal teams should map Levee's controls and evidence to your firm's specific obligations.

What evidence can we give an auditor?

The policy in force (from the Portal or policy.json); the audit trail of every request, approval, and denial with user, computer, time, and resource; and exports from the Portal's audit trail (CSV or JSON). See Activity and audit.

Daily use

Can I open the project's files in my usual apps?

Yes. A project is a normal folder in your user profile, so you can open its files in Excel, Word, or any other app on your computer. If Git is installed, Levee keeps a change history for new projects and saves a checkpoint when a project stops, so every agent session can be reviewed.

How do I see what the agent changed?

In Easy mode, the chat shows each edit the agent made as a before-and-after change, and you can preview the files it read or wrote. In Advanced mode, the project's Activity tab lists what the agent reached. If Git is installed, the checkpoint saved when the project stops shows every changed file. See Activity & audit.

Can the agent upload files to an online service?

Only if your policy allows that website and the agent has credentials for it inside the sandbox. Many organizations prefer people to review the agent's work and upload it themselves, from outside the sandbox.

Can the agent install npm or pip packages?

Yes, from registries your web policy allows. For control per package through your own registry, see Packages (Preview).

Can the agent use internal web apps that need a sign-in?

Yes, through connected identities: you sign in, and Levee attaches the session to the agent's requests without the agent seeing it.

What are plugins?

Plugins (Preview) give the agent extra tools, for example to work with a business application. They come only from an administrator or from your organization's Vediram Cloud policy. If a plugin needs a value only you can provide, enter it in Settings > Plugins. See Plugins.

What does Easy mode approve automatically?

Only the agent's own prompts about actions inside the sandbox, such as running a command in the project. Anything that crosses the sandbox boundary still goes through policy and Levee approvals.

Does Levee remember my approvals?

Only if you tick Remember this decision. A remembered decision applies to that one project and to you; other projects and other users are asked again. See Approvals.

Can I run several projects at once?

No. Only one project runs on a computer at a time. To start another one, stop the running project first. Levee says Another project is already running. Stop it, then start this one.

What happens to my files if I uninstall Levee?

Nothing. Project folders, policy, and the audit trail stay in place. See Updates and uninstall.

Buying and support

How do we get Levee?

Request access at vediram.com. Vediram works with you on deployment and policy.

How is Levee licensed?

Contact Vediram through vediram.com for licensing and pricing.

How do we get help?

Signed-in customers can open a request on this site under Support requests. Include the output described in Collecting logs for support.