Today we are introducing Vervain, a control layer for the data your AI agents touch.
Vervain maps where agent context and derived data persist, then produces bounded evidence of what a deletion or a revocation actually reached.
Your identity and authorization systems decide whether an agent may read a customer record. They do not show where that record went next.
A single agent turn can leave copies in a context window, a reused cache prefix, a vector index, a tool result, a log line, and a checkpoint. Each has its own lifetime and its own owner. None of them reports back to the system that approved the read.
So when a customer asks you to delete their data, or someone questions a tenant boundary, the honest answer today is usually an estimate. That estimate is what enterprise security review is built to find.
The gap widens with every agent you deploy. More context, more tools, more places for one record to come to rest.
Vervain instruments the layer below the read decision. It traces a specific record forward, from the moment an agent reads it to every place a derivative came to rest, and reports what a revocation reached and what it did not cover.
It runs on open-source and open-weight stacks: vLLM, SGLang, and Ollama, locally or on infrastructure you operate. It runs inside your environment, on the same machines as the stack it governs.
Vervain reports what it observed, and it states the limits of that observation in the same report. A surface it cannot instrument is named rather than assumed clean. It does not issue a seal, a score, or an attestation. Finding no cross-tenant path is a statement about the surfaces we reached, not about a whole system.
We are running a one-week cross-tenant contamination assessment for teams operating multi-tenant agent systems.
The question is narrow and concrete. Can you show today that one tenant's data has never appeared in another tenant's context? We instrument your stack, trace real requests, and hand back a written map of the persistence points we reached, the specific requests behind any cross-boundary path we observed, and an explicit list of what the assessment did not cover.
Vervain is in private development. There is no released product and no customer list to point at yet. We are taking a small number of design partners now. If your team runs agents on shared infrastructure, we would like to hear how you answer that question today. Write to us.
- PJ Mullin, Vervain