The independent governance plane for AI agents

Agents act. Aegis governs the irreversible.

Wherever your agents run — any cloud, any model, any framework — Aegis authorizes every action before it happens, holds the consequential ones for a human, and leaves evidence your auditors can verify for themselves.

Book a working session Explore the platform

Cedar · default-deny OAuth 2.1 MCP · A2A Self-hosted in your VPC

Semantic policy credit-limit-unattended@v3

No agent issues a customer credit above $250 without an operator’s approval.

compiled → Cedar · default-deny · enforced at every call

Enforced decisions tsk_9f2c41

09:14:05.118 wl_dispute-ops Read case context crm.cases.read Allow

09:14:31.902 wl_dispute-ops Read fraud investigation notes risk.notes.read Deny

09:15:02.431 wl_dispute-ops Issue credit $254.97 billing.credit.issue held for approval · routed to card-ops · the call has not returned yet Hold

decision dec_01JD7Q4M8EK3PV7A · chain HMAC-SHA256 · verified
identity org_northwind → wl_dispute-ops → tsk_9f2c41

The control loop

Four things have to be true at once.

Identity

Every agent, tool call, and hop carries an identity chain: organization, workload, the person who delegated, and the individual task it is doing.

Policy

Rules written in plain language compile to deterministic, default-deny enforcement that runs before the action does.

Human oversight

Policy decides which actions need a person. The task holding that action waits at the gateway; the others carry on.

Evidence

Every decision lands in a tamper-evident, HMAC-chained record. Break one link and the chain stops verifying.

Authorized, not inferred

Deterministic enforcement beats a guess about intent.

Models are probabilistic. Authorization cannot be. Aegis compiles your plain-language rule into Cedar, a formally verifiable default-deny policy language, and evaluates it on every call an agent makes out — to a model, to a tool, or to another agent. The same request produces the same decision, and the decision is recorded before the action is permitted to happen.

Every action is checked against an authorization that was written down first, sealed, and can be read back by whoever asks.

Default-deny by construction
Reproducible decisions
Policy changes bind at the next call

What you write

“No agent issues a customer credit above $250 without an operator’s approval.”

Compiles to

credit-limit.cedarcredit-limit-unattended@v3 · default-deny

// compiled from a semantic policy — reviewed, versioned, enforced
permit (
  principal is Aegis::Workload,
  action == Aegis::Action::"mcp:tools/call",
  resource == Aegis::Tool::"billing.credit.issue"
)
when {
  context.arguments.amount_usd <= 250
};

// above 250 → the approval rule holds the task for an operator
// anything not permitted here is denied

Neutrality

Your agents run everywhere. Your governance should too.

Aegis is independent of the clouds and model providers it governs. One policy model covers OpenAI-compatible LLM traffic, MCP tool calls, and A2A agent-to-agent calls, across whatever framework each team picks next.

Any framework Any model Any cloud

Aegis governance plane

Provable decisions allow · deny · hold for a human

Deployment

Self-hosted, in your VPC

The control plane runs inside your own environment, under your own keys. Your policies and your evidence stay where your auditors already look.

Protocols

Governed at the wire, both directions

MCP tool calls and A2A agent-to-agent calls are read as protocol, so a rule can turn on the tool name and the arguments inside it. OAuth 2.1 throughout, and the agent never holds an upstream credential.

Coverage

One policy model, every surface

The same rule governs a model call, a tool invocation, and a delegation to another agent. PII detection rides the same path, with anonymize, block, or flag as the outcome.

Provable accountability

Ask “what did this agent do, and who authorized it?” — get a provable answer.

Aegis reconstructs the full call graph of a task at the gateway: every model call, every tool, every hop between agents, with zero agent instrumentation. There is nothing to adopt in your process and nothing to change in your agent.

Each decision record is chained to the one before it with an HMAC and bound to the identity that caused it. An altered or missing record fails verification, and your auditor runs that check themselves — on your infrastructure, with your keys, without asking us for anything.

Nothing to install in your agent
Attributable org → workload → user → task
Chain verification runs on your side

Decision record dec_01JD7Q4M8EK3PV7A 5 of 7

Identity chain

orgnorthwind workloaddispute-ops task9f2c41

Action: billing.credit.issue · $254.97
Policy: credit-limit-unattended@v3 · default-deny
Verdict: Hold
Prev hash: 0x41ba07…c9e2
Next in chain: dec_01JD7Q4M8ETB6QW9 · Allow · approved by j.okafor · card-ops · 09:41:18Z

tsk_9f2c41 · 7 decisions · org chain · 4,184 records · intact

Where Aegis sits

Governance that belongs to you.

Plenty of tools touch part of this problem. Here is the line between them and a governance plane.

Against hyperscaler agent platforms

Independent of every platform it governs.

A control plane owned by the platform it governs can only govern that platform. Aegis answers to you instead. One policy model covers every cloud, runtime, and model provider, and it deploys inside your own environment under your own keys.

Against identity-only tools

Identity tells you who your agents are. Aegis governs what they do.

Aegis sits on top of the identity provider you already trust and carries that identity into runtime authorization. The check happens at the call. Consequential actions route to a named person, and whatever came of it is on the record.

Against probabilistic intent-judging

Decisions you can reproduce.

Controls that ask a model to judge intent give a different answer on a different day, and you will not learn which day mattered until afterwards. Aegis evaluates a compiled, default-deny policy: the same input yields the same verdict, with the authorization written down before the action runs.

Against sandboxes and isolation

Sandboxes keep an agent in its box. Aegis proves what your agents did, and who authorized it.

Isolation limits blast radius. It cannot tell you which action was approved, by whom, under which rule. And it has no way to stop one irreversible step for a human without stopping the agent.

Why now

The control layer is being decided this year.

Protocols

Agent traffic has a shape you can govern

MCP and A2A have consolidated under neutral foundations. Agent-to-tool and agent-to-agent calls now share a wire format — which means they can be authorized once, for everything, instead of per integration.

Regulation

Obligations that only runtime can satisfy

EU AI Act enforcement turns on runtime control, meaningful human oversight, and records that survive inspection. Those are properties of the moment an action is taken. A document describing the intent to control it does not have them.

Volume

The decisions arrive whether the controls do or not

Gartner projects that 15% of day-to-day business decisions will be made autonomously by agentic AI by 2028. Every one of them is an action someone will eventually be asked to account for.

Recently shipped

What just landed.

Aug 2026

Semantic Policies

Write the rule in plain language. Aegis compiles it to deterministic, default-deny enforcement and shows you the compiled Cedar before you enable it.

Aug 2026

A2A v1.0 governance

Agent-to-agent calls are policy-checked in both directions — outbound delegation and inbound requests — with task state available as a policy attribute.

Aug 2026

Management API and sandbox provisioning

Stand up a fully governed environment through the API: organizations, workloads, policies, gateways. An evaluation starts in minutes rather than a procurement cycle.

I spent my career on engineering and security controls in regulated systems — Cisco, then JPMorgan Chase. What stayed with me is how much of that work happened after the fact: reconstructing what a system had already done, out of logs nobody designed for the question being asked. That is survivable when the system is an overnight batch job. It is not survivable when the thing acting is an agent that already made the call. So this time the control layer came first, which a fair number of people will tell you is backwards. I have watched the other order enough times.

Dorin Ciobanu Founder & CEO, IDv4

Start here

Start with one governed workflow.

Bring a single workflow you would want an agent to run. We scope a pilot around it in one working session.

The workflow itself, and the systems it touches
The actions that must not happen without an approval
The record you would have to produce if someone asked six weeks later, when nobody remembers the run

Book a working session Request a sandbox