Sober Agentic Infrastructure, Inc. / VAREK v1.9.2 shipped
Authorization before execution.
An autonomous agent decides what it wants to do. VAREK decides whether it may. Every action is held at the kernel boundary and resolved against declared policy before it runs — not logged after.
Enforced with seccomp-BPF and seccomp user-notify
The decision procedure
Three verdicts. Only one of them runs.
VAREK evaluates each requested action with an SMT decision procedure. It returns one of three answers, and it never manufactures a fourth.
Declared policy permits the action. The call is released to the kernel and proceeds normally.
Declared policy forbids the action. The call is refused at the boundary and never reaches the kernel.
The procedure cannot prove either answer. The call is refused rather than guessed, and the gap is reported so the policy can be tightened.
Why it is built this way
Detection is not control.
Most agent safety today is observation: guardrails that score a model's output, monitors that alert on what already happened, audit trails that explain the incident afterward. That is useful, and it is not control. An action that has already been taken cannot be un-taken.
VAREK moves the decision point to the last place where refusal is still possible — the system call itself. Policy is declared ahead of runtime as a compositional action graph. At runtime, the agent's process is confined by a default-deny allowlist and each covered call is suspended at the boundary while the decision procedure runs. The result is deterministic: the same action against the same policy always produces the same verdict.
Because enforcement lives below the model, it holds regardless of which model is driving, how the agent was prompted, or whether the agent has been manipulated.
Medicine does not deploy systems that are usually right. We do not accept a ventilator that works most of the time. Agentic software is being held to a lower standard than any instrument I was ever allowed to touch.Kenneth Douglas, MD — Founder and CEO
How a deployment works
Declare, intercept, decide.
Declare
Write what the agent is allowed to do as a compositional action graph, ahead of runtime. Policy is authored and reviewed as an artifact, not discovered from logs after an incident.
Intercept
Launch the agent under the VAREK runtime. Its process is confined by a default-deny allowlist, and covered calls are suspended at the kernel boundary using seccomp-BPF and seccomp user-notify.
Decide
An SMT decision procedure returns SATISFIED, UNSATISFIED, or UNKNOWN. Only SATISFIED proceeds. Every verdict is recorded with the policy that produced it, so a reviewer can reconstruct exactly why any action was allowed or refused.
Where to go next
Read it. Run it. Break it.
Documentation and language reference
The policy language, the runtime model, the verdict semantics, and worked examples for putting an agent under VAREK.
Open the docs github.com/kwdoug63/varekSource, releases, and issues
VAREK v1.9.2 under the MIT License. Read the enforcement path yourself, file issues, and open pull requests.
Open the repositoryFor investors
The company around the runtime.
VAREK is open source so that the enforcement path can be inspected by the people who have to trust it. Sober Agentic Infrastructure is the commercial layer above it — policy tooling, support, and assurance for organizations deploying agents where a wrong action is not recoverable.
- Entity
- Delaware C-corporation, incorporated March 2026. Headquartered in Dallas–Fort Worth.
- Product status
- VAREK v1.9.2 shipped and publicly available under the MIT License. Not a prototype.
- Intellectual property
- Patent pending. Three provisional applications on file covering the three-verdict decision procedure, the kernel-interception architecture, and compositional action-graph policy decision. Non-provisional conversion begins March 2027.
- Federal readiness
- SAM.gov registered with an active CAGE code, positioned as a non-traditional defense contractor. Pre-execution control of autonomous systems is an explicit national security priority.
- External review
- Independent third-party security audit of the enforcement path is in procurement.
- Use of first capital
- The first seed dollar funds a second technical hire — a kernel and formal-methods engineer — alongside the security audit and design-partner deployments.
Founder
Kenneth Douglas, MD
Founder and Chief Executive Officer. A physician by training, no longer in clinical practice. VAREK comes directly out of that training: clinical systems are not permitted to be usually right, and the argument of this company is that agentic software should not be either. He is also the author of the novel Vortex.
Get in touch · LinkedIn · X
Advisor
Dennis Cagan
Founder of Caganco Incorporated, Dennis Cagan is a veteran technology entrepreneur, board governance expert, and executive advisor who has founded or co-founded more than a dozen companies and served on over 70 corporate boards. A member of the IT Hall of Fame and creator of the trademarked Shadow CEO® methodology, Dennis has spent decades mentoring founders, guiding corporate governance, and helping technology companies scale from startup through growth and transition.
As an advisor to Sober Agentic Infrastructure, Inc. and VAREK, he provides strategic leadership in governance, enterprise growth, capital formation, and organizational development.
Next step
Bring us an agent you would not let run unsupervised.
We are talking with investors, design partners running agents in production, and federal teaming partners.