As AI agents move into production, they do things. They call tools, move money, hit APIs, and act on a person's behalf. The question every one of those actions raises is simple and unforgiving: should this agent, right now, be allowed to do this?
Answering that in real time, before the action runs, is what Vorim does. Today we are sharing what we are building next to make that answer faster and more open: a model called Voram 1.
The gap we kept running into
There is a healthy ecosystem of open "guardrail" models now: Llama Guard, ShieldGemma, Granite Guardian, WildGuard, and reasoning guards like GuardReasoner. They are good. But they all answer the same kind of question: is this piece of text harmful? They classify content.
That is not the question an agent forces. The agent question is different: given this agent, holding these permissions, with this trust history, trying to take this specific action under this org's policy, do we allow it, deny it, or escalate it to a human? That is an authorization decision about an action, not a safety judgment about text.
When we looked across what exists today, we found the field split cleanly in two, with a gap down the middle. On one side are learned models that reason about agent actions, but none of them is bound to the agent's identity or a signed audit trail. On the other side are excellent open projects that do bind identity and signed audit to an allow, deny, or escalate decision, but they make that decision with deterministic rules, not a learned model. Some of them argue, reasonably, that rules are the right tool for the gate.
We think both are needed. Rules are exact and fast for the cases you can enumerate. A model earns its place on the cases you can't, the novel or ambiguous action a rule never anticipated, where the honest answer is often to escalate to a human rather than guess. Voram 1 is our attempt at that missing piece: a learned model for the agent-action decision, bound to identity and a signed audit trail, released open, so it augments the deterministic checks rather than replacing them.
Voram 1 is not another chatbot
It is worth being blunt about what Voram 1 is not, because the word "model" now means one thing to most people. ChatGPT, Claude, Mistral, Cohere, and the open models like Llama and Qwen are general-purpose generative models. You give them a prompt and they write, reason, and generate. They are extraordinary, and they are usually the brains inside a modern AI agent.
Voram 1 does none of that. It does not chat, write code, or generate open-ended text. It answers one narrow question, over and over, at the moment an agent tries to act: may this agent take this action, right now, under this policy? The only outputs are allow, deny, or escalate, tied to the agent's identity and written to a signed audit trail. It is not the agent's brain. It is the gate the brain has to pass through.
This is a proven shape, not a bet on an exotic idea. The guardrail models above (Llama Guard, ShieldGemma, Granite Guardian) already prove that a small, dedicated model sitting inline on every request beats routing each check through a big general model, on latency and on cost. Independent work backs it: a June 2026 study of inline moderation found small specialized classifiers match frontier-model detection at one to two orders of magnitude lower latency and cost. The honest version of the claim is not "a specialist is always smarter." It is that for a narrow, high-frequency, latency-bound decision, a specialist gives you the same answer far faster and far cheaper, which is exactly what an inline authorization gate needs. Voram 1 applies that shape to a question those content guards do not answer: whether an agent action is authorized.
Why it has to be a small, fast, dedicated model
The obvious objection is: why not just ask a frontier model? So we tested exactly that. We built an evaluation set from our real production decisions, grounded in the actual policy primitives our engine enforces (scope checks, agent status, velocity limits, transaction thresholds, trust floors, destructive-action protection, named-approver escalation, payload redaction). Then we benchmarked a strong frontier model, few-shot, on it.
The result was clarifying:
- Accuracy: 90%. The frontier model is genuinely good at this decision.
- Latency: 964 milliseconds. On average, nearly a full second per decision.
Here is the problem. Authorization sits inline, in front of every single agent action. A gate that adds the better part of a second to every action is unusable at that position; it would make every agent visibly slow. The budget for an inline check is under 100 milliseconds. And this is not a "wait for the next faster model" problem: even the fastest hosted frontier variants take a few hundred milliseconds of model time before you add the network round-trip, so a hosted API cannot structurally hit a sub-100ms inline budget. It is a network-plus-inference floor. A small model you run yourself, next to the agent, skips the network hop entirely, which is what makes the budget reachable at all.
So the case for Voram 1 was never "beat the frontier on accuracy." The frontier is already accurate. The case is speed. A purpose-built small model can make the same decision at a fraction of the latency, on your own hardware or in your own cloud, with the weights open for you to inspect and trust. That is what makes real-time, per-action authorization actually viable.
How we are building it
Voram 1 is a fine-tune of an open base model (Qwen 3, Apache 2.0), trained to reason over an agent action and emit a verdict, allow, deny, or escalate, along with a short rationale suitable for a signed audit record. It is built to be served for sub-100ms inline inference, optimized with TensorRT-LLM and FP8 on NVIDIA GPUs, and small enough to run on your own hardware or in your own cloud, so it fits in the runtime path rather than off to the side.
The training data is where we have an unusual advantage. Vorim already runs a real decision engine, so every decision it makes, and critically, every escalation a human later approves or rejects, is a correctly-labeled example of exactly this task. Most teams building a guardrail model spend their entire budget manufacturing labels. We generate them as a byproduct of running the product.
The honest caveats
We would rather tell you what is real than oversell it.
Voram 1 is in active development. It is not released yet. The first version will essentially be a fast, open, local mirror of the policy decisions our engine already makes, at a fraction of the latency. The deeper value, reasoning well about novel actions that no rule anticipated, grows as real decision data accumulates. That is a flywheel, not a launch-day feature, and we are early on it.
We are also going to publish the benchmark alongside the weights, so you can check our numbers rather than take our word for them. If a well-prompted frontier model is good enough for your use case and you do not need inline latency, you should use that. The reason to reach for Voram 1 is when the authorization decision has to be fast, private, and on your own infrastructure.
Why open, and why closed models still matter
We think the future of this particular job is open, and we do not think that is a slogan. When a model gets to decide whether your agent may move money, delete data, or call an external tool, you should be able to open it up, see how it decides, run it on your own hardware, and keep it running even if a vendor changes its terms. A gate you cannot inspect is not really a gate you can trust. That is why Voram 1 is open, under Apache 2.0.
This is not a case against closed frontier models. ChatGPT and Claude are doing things no open model matches yet, and for the hardest open-ended work they are often the right call. The two coexist, and we think they should. Let the powerful closed models do the open-ended thinking, and let a small open model like Voram 1 stand at the gate, deciding what those agents are actually allowed to do, in the open, where anyone can check the rules.
How to get the weights
Voram 1 will be released open, under Apache 2.0. You will be able to download the weights, run it yourself, read the benchmark, and see exactly how it decides. The model is free and open on purpose: for a trust product, you should be able to inspect the thing making the decisions. If you would rather not host it yourself, we offer a managed version and the surrounding dashboard, identity, permissions, and the signed audit trail, as our paid plans.
If you want the weights, the benchmark, and early access when Voram 1 lands, join the waitlist at vorim.ai/voram-1/waitlist. We are building it in the open, and we will share the results, good and bad, as we go.
Ready to build with agent identity?
Free plan: 10 agents, 10K auth events/month, full SDK access. No credit card.