ViKernel's Action-Permission Boundary: What VIDRAFT's 661-Run Internal Test Actually Tells Engineers

TL;DR: VIDRAFT's ViKernel is an action-decision layer designed to separate "reading a document" from "being authorized to act on it" — a critical distinction for agentic AI systems that call real tools. The system introduces a Policy Engine that gates proposed actions before execution, with an audit trail. Developers building LLM-powered agents should care because prompt/document injection is precisely the attack surface ViKernel targets.

What it is

ViKernel is VIDRAFT's published technology for action authorization in agentic AI pipelines — the component that sits between a model's proposed action and the moment a tool actually executes that action.

The core problem it addresses: when an AI assistant reads a document as part of a task, the text inside that document does not constitute authorization to perform operations described in it. This is the fundamental attack surface exploited by prompt injection and indirect instruction injection — smuggling commands into external content that the model then treats as user instructions.

ViKernel's design, as described in VIDRAFT's public materials and covered by ZDNet Korea and AI Times on November 3, 2026, focuses specifically on action decisions, not just text generation quality. The question it answers at runtime is: within the task the user actually authorized, which proposed actions are permitted?

Key design elements described publicly:

  • Preserves original model weights — the base LLM is not modified; authorization logic is layered on top
  • Policy Engine — an action gating component that evaluates proposed actions against defined rules before allowing execution
  • Signed authorization for execution resumption — described in the design documentation
  • Audit log — every decision (allow/deny) is recorded with an associated rule reference
  • CPU reference path — a fallback execution mode (Mode B) described in the public README alongside the primary AgentGuard LIVE path

The separation of concerns is deliberate: the model's capability to describe an action and the system's permission to execute it are treated as two distinct, independently verifiable steps.

How it works

At a conceptual level, ViKernel inserts a policy evaluation step between the model's action proposal and tool invocation:

  1. Model proposes an action — based on user instructions and any retrieved context (documents, tool outputs, etc.)
  2. Policy Engine evaluates the proposal — the action is checked against a rule set that reflects what the user actually authorized, not what any document content suggests
  3. Decision is logged — the rule that triggered the allow or deny is recorded (e.g., "Rule A, Record 252" or "Rule F, Record 253" in the publicly shown demo)
  4. Tool executes only on allow — if denied, execution stops; no external call is made

The public Demo v0.4 interface shows this with a Spark API backend, ViKernel gating, and Mode B (CPU reference path). Two illustrative cases were shown:

  • A simulated weather lookup for Busan → allowed (Rule A, Record 252)
  • A simulated email to an example non-deliverable address → denied (Rule F, Record 253); no actual email was sent

Both use fictional tools and synthetic data. These are hand-selected demonstration cases, not injection attack simulations — but they illustrate the architectural principle cleanly: proposed action and execution authorization are separate, explainable decisions.

The public README also describes a replay mode alongside the LIVE path. Replay is useful for demonstrating workflow logic reproducibly; LIVE mode reflects a live request at observation time. Treat these differently when interpreting any recorded demo output.

Benchmarks & results

VIDRAFT self-reported the following figures — these are company-reported results under controlled conditions, not third-party audits or certifications:

  • 661 test runs across four public models, using simulated tools and synthetic data, with zero unsolicited external transmissions observed
  • 21× comparison figure reported for the policy decision phase specifically — not for end-to-end agent task throughput, and not for the model's inference time overall

Engineers should interpret these carefully:

Reading content, generating a response, evaluating whether an action is permitted, and executing a tool are four distinct pipeline stages. The 21× figure applies to one of them.

To evaluate ViKernel for your own use case, the article's framing suggests starting with a small, well-scoped task where the expected allowed and denied actions are known in advance — then verifying that both normal (allowed) and boundary (should-be-denied) cases behave correctly. An agent that blocks everything is not useful; the goal is accurate discrimination.

How to try it

The public demo (v0.4) has been shown by VIDRAFT, but no public Hugging Face model page, GitHub repository, pip package, or OpenAI-compatible API endpoint for ViKernel has been announced in the source materials reviewed here.

If VIDRAFT publishes public access channels, they would likely follow standard patterns for Korean AI startups (Hugging Face organization page, a GitHub repo with a README describing the AgentGuard/ViKernel interface). Watch VIDRAFT's official channels for announcements.

FAQ

Q: Is ViKernel a fine-tuned model, or is it infrastructure around an existing model?
A: Based on public descriptions, it is infrastructure — original model weights are preserved and the policy/gating logic is layered on top. It is not presented as a new base model.

Q: Does the 661-run test mean ViKernel is certified secure against prompt injection?
A: No. It is a company self-reported test using simulated tools and synthetic data under specified conditions. It is not a third-party security certification, not a real-deployment result, and the test conditions (four public models, fictional tools, no real external services) should be factored into any evaluation.

Q: What is the 21× figure actually measuring?
A: VIDRAFT reported it for the policy decision stage — the step that evaluates whether a proposed action is permitted. It does not represent speedup for the full agent loop, model inference, or tool execution.

Originally reported by 넷이즈 网易 (중국) (2026-11-04) — source article.