VediramOverview
What Vediram Levee is, how it keeps an AI agent inside the limits your organization sets, and the words used across this guide
Vediram Levee lets an AI agent work on your files and data on a Windows computer, inside a closed workspace called a sandbox. The agent can only reach what your organization's rules allow, it never holds real passwords or keys, and every decision is recorded.
What is Levee?
Levee is a Windows application that runs an AI tool, such as Claude Code, Codex CLI, or GitHub Copilot CLI, inside a sandbox on your own computer. You give the agent a folder of work, called a project, and ask it to do things: analyze a spreadsheet, draft a report, query a database, tidy a set of documents.
Inside the sandbox, the agent can read and change the files in its project folder freely. Anything beyond that folder, such as a website, an AI model, a database, or one of your own documents, goes through Levee, which checks your organization's rules (the policy) first.
Levee does not include its own AI. It is the controlled place where the AI tool runs.
Why does the agent need limits?
An AI agent is useful because it acts on its own. It also follows instructions it finds in what it reads. A web page, an email, or a document can hide instructions that try to make the agent send data out or reach systems it should not. This is called prompt injection.
Levee assumes the agent may be tricked in this way. So the limits are not instructions to the agent. They are enforced by Windows and by Levee's own services outside the sandbox, where nothing the agent reads can change them.
How does it work?
Each project runs in its own sandbox, a Windows container. Your project folder appears inside it at C:\workspace. Files and folders you choose to share from elsewhere on your computer appear under L:\.
The sandbox has no direct route to the network. Each kind of outside access goes through its own Levee channel, which applies your policy:
| Channel | What the agent can do | How Levee controls it |
|---|---|---|
| Web access | Visit websites and call online services | Allow, deny, or ask rules per website. Everything else is refused. Web access |
| Model access | Use AI models from Anthropic, OpenAI, Azure OpenAI, Azure AI Foundry, or AWS Bedrock | Only approved models, with usage budgets. The real API key never enters the sandbox. Model access |
| Database access | Run SQL queries on a database | Rules per data source for the kind of query, the tables, and the number of rows. The agent never sees the password. Database access |
| Web search (Preview) | Search the web through Brave, Linkup, or Tavily | By default, you see and approve each search. Web search |
| Microsoft 365 (Preview) | Read and edit open Word, Excel, and PowerPoint documents; search mail and draft messages in Outlook | A fixed list of operations. Nothing can be sent or deleted. Microsoft 365 |
| Packages (Preview) | Install npm and pip software packages | Rules per package, from your organization's own registry. Packages |
| Files | Use your files and folders outside the project | You share a file or folder with a project from the app, read-only or read and write. Anything not shared does not exist for the agent. File access |
| Plugins (Preview) | Use extra tools that plugins (MCP servers) provide | Only plugins an administrator installs on the computer or your organization enables in Vediram Cloud. Plugins |
Three rules apply to every channel:
- Default deny. If the policy does not allow something, it is refused. A missing or unreadable policy section means "deny everything" for that channel.
- Same answer for every refusal. The agent gets the same reply whatever the reason, so it cannot use refusals to learn your rules. The real reason is in the audit log.
- Every decision is recorded. Every allow, deny, and approval is written to an audit log on the computer, which your IT team can forward to central logging. If the audit log cannot be written, Levee raises an alert. See Security model.
Words used in this guide
| Term | What it means |
|---|---|
| Project | A folder of work plus its own sandbox, approvals, and enabled AI tools. Projects live in your project folder, %USERPROFILE%\LeveeProjects by default. See Projects. |
| Sandbox | The closed Windows container a project runs in. It starts when you start the project and is removed when you stop it. Only one project runs on a computer at a time. |
| AI tool | The AI agent program (Claude Code, Codex CLI, or GitHub Copilot CLI). An administrator makes it available, and you turn it on for each project. See AI tools. |
| Policy | The rules for the computer, stored in %ProgramData%\Vediram\Levee\policy.json. An administrator writes it, or it comes from Vediram Cloud. See How policy works. |
| Approval | A decision you make when the policy says "ask": approve or deny, once or remembered for that project. See Approvals. |
| Audit log | The protected record of every request, decision, and event on the computer. See Activity & audit. |
| Container runtime image | The Windows image every sandbox starts from. Levee downloads and checks it automatically. See Container runtime. |
| Connected identity | A sign-in to a website that you do in a Levee browser window, so the agent can use that website as you without ever seeing your session. See Connected identities. |
| Plugin (Preview) | A package that gives the agent extra tools. Some ask you for values only you can provide, in Settings > Plugins. See Plugins. |
| Vediram Cloud | The optional central service: organization-wide policy written in the Vediram Portal, device activation, and optional audit forwarding. See Connecting to Vediram Cloud. |
Who does what?
| Role | What they do | Start here |
|---|---|---|
| User | Create projects, turn on an AI tool, share files, work with the agent, answer approval requests | First launch, Desktop app |
| IT administrator | Prepare computers, install Levee, make AI tools and plugins available, deliver policy, connect devices to Vediram Cloud | System requirements, Planning a deployment |
| Security or policy owner | Decide what agents may reach, which models they may use, and what needs a person's approval | How policy works, Security model |
| Auditor or compliance officer | Review who approved what and what the agent reached | Activity & audit, Audit event reference |
For your IT team: what runs on the computer
Levee installs from a single MSI. Its programs go under %ProgramFiles%\Vediram\Levee, where only administrators can change them. Its data stays under %ProgramData%\Vediram\Levee. It adds:
- Levee service (
LeveeService, "Levee AI Sandbox Service"). A Windows service running as LocalSystem. It starts and stops sandboxes, runs the policy channels, applies policy, and writes the audit log. - Levee Container Engine (
LeveeContainerEngine). A private Windows container engine used only by Levee. Docker Desktop is not needed, and an existing Docker installation is neither used nor changed. - Levee app (
levee-app.exe). The desktop application where users manage projects, chat with the agent or open a terminal, answer approvals, and review activity. Standard users can run it. leveecommand-line tool. For administrators and power users. See the CLI reference.
The installer also adds LeveeFS, the component that shows shared files inside the sandbox: a file-system driver and its LeveeFSHost service. See Installation.
Levee handles agent traffic on the computer itself. Agent requests do not pass through Vediram servers unless you choose a Vediram-hosted model endpoint.
Next steps
- Check the system requirements.
- Install Levee on a test computer, or plan a deployment to many computers.
- Follow First launch to create a project and start an agent.
- Read the FAQ for the questions people ask most.