Verity · How it works

From AI keystroke to governed merge — in one Git flow.

Verity runs entirely inside your existing Git and GitHub workflow. No new toolchain. No agent proxy. Just a policy layer that intercepts every AI-generated PR and enforces your standard before anything merges.

Five steps. Zero friction.

01
Developer pushes AI-generated code

A developer uses an AI coding agent (Cursor, GitHub Copilot, Devin, or any other tool) to write or modify code, then opens a pull request as normal. No change to their workflow.

git push origin feature/ai-add-auth-endpoint
02
Verity intercepts the PR

Verity's GitHub App receives the PR webhook. It reads the diff, detects AI authorship signals (commit metadata, coding agent signatures), and begins policy evaluation.

Verity: PR #419 received
AI source detected: Cursor · claude-3-5-sonnet
Diff size: 247 lines · Files: 4
03
DEO created and policy evaluated

Verity creates a Developer Execution Object — a signed, structured record of the change. The DEO is then evaluated against your ISO 42001-aligned policy rules. Deterministic: not an LLM judgement call.

DEO created: deo_a3f8b2c1
Risk signals: auth_scope_modified, new_external_call
Policy verdict: GATE — lead review required
04
PR gated — reviewer notified

GitHub status check is set to "pending". The designated reviewer receives a notification with the DEO summary — risk signals, policy verdict, and AI attribution. The PR cannot merge until they act.

PR #419 · Add auth endpoint AWAITING REVIEW
05
Approved — provenance committed

Once the reviewer approves the DEO, the PR is unblocked and can merge. The signed DEO is committed to the repository's git history as a permanent, tamper-evident record. Available to compliance, legal, and security teams forever.

Approved by: j.chen@company.com
DEO committed: .verity/deo_a3f8b2c1.json
Merge unblocked. Provenance stored.

Works inside your existing stack.

🔗
GitHub App

Install via the Verity GitHub App. No infrastructure to run. Verity connects to your repositories via webhook and GitHub status checks.

🔨
Policy as code

Define your rules in a verity.yaml file committed to your repository. Version-controlled, reviewable, and auditable just like any other config.

📊
Dashboard + reports

See all DEOs, policy verdicts, and reviewer actions in one place. Export compliance reports for audits. Filter by repository, AI tool, or risk level.

👥
Team permissions

Assign reviewer roles per repository or team. Escalation paths for blocked PRs. Audit log of every approval, rejection, and override.

Ready to govern your AI-generated code?

Verity is in early access. Join the waitlist to be first in line.

Get early access ← Verity overview