Point your agent at one URL.
Every call is governed.
An OpenAI-compatible endpoint, standard MCP OAuth 2.1, and protocol-native A2A. Nothing in your agent has to move. Change a base URL and every model call, tool call, and agent-to-agent hop is checked against policy and recorded as evidence.
- base_url = "https://api.provider.example/v1"+ base_url = "https://llm.your-aegis.example/v1"
llm:chat.completions
Allow
identity checked · policy evaluated · decision recorded
dec_01JQ8ZK3M2T9VR4C · hmac-chained · verified
One line in your client governs every model call.
Point any OpenAI-compatible client at your Aegis endpoint and authenticate with the agent’s own credential. The SDK, the request shape, and streaming all behave exactly as before. What changes is that every call now carries an identity and leaves a decision record.
- The credential is the identity. Calls are attributable org → workload → user → task. A shared key that four services borrow cannot do that.
- Provider keys stay in Aegis. The agent process never holds them, so a compromised agent cannot spend them elsewhere.
- Nothing else moves. Tools, function calling, streaming, and response shapes pass through unchanged.
import osfrom openai import OpenAIclient = OpenAI(+ base_url="https://llm.your-aegis.example/v1", # the only change+ api_key=os.environ["AEGIS_WORKLOAD_TOKEN"], # its own identity — not a provider key)resp = client.chat.completions.create( model=os.environ["MODEL"], messages=[{"role": "user", "content": "Pay invoice INV-4471."}],)# identity checked · policy evaluated · decision recorded — per call
{ "mcpServers": { "aegis": { "type": "http",+ "url": "https://mcp.your-aegis.example/mcp" } }}// Standard OAuth 2.1: discovery, PKCE, and the// consent screen your client already implements.
tools/list
Returns only the tools this agent’s policies allow. Unauthorized tools are not hidden behind an error — they are not in the list.
tools/call
Evaluated against policy before it reaches the upstream server, with the arguments as policy inputs.
Connect your client. It sees only the tools policy allows.
Aegis speaks MCP natively and authenticates with standard OAuth 2.1: discovery, PKCE, dynamic client registration. Your client needs no auth shim and no fork, and no per-tool credential is ever handed to the agent.
- Servers stay where they are. Aegis fronts the MCP servers you already run; upstream credentials stay on the Aegis side of the connection.
- Every
tools/callis a decision. Allowed, denied, or held for a human — recorded either way, chained to the agent’s identity and its task. - Arguments are policy inputs. Rules read the amount, the recipient, and the record named inside the call.
When policy says no, your agent gets an answer it can act on.
A blocked call returns a structured error. Not a timeout, and not a mangled tool response the model has to guess at. The agent reads which policy applied and why, then adapts: take an approved path, retry inside the limit, or hand the task to a person. A denial means no approver can authorize the action at all — where there is a path through a person, policy returns a hold instead.
- Named policy, plain-language reason. The response carries the rule name and the sentence a reviewer would read.
- A decision id that resolves. It points at the full record: inputs, verdict, policy version, position in the chain.
- Denials are evidence too. Allows, denials, and holds land on the same tamper-evident, HMAC-chained record set.
{ "error": { "code": "policy_denied", "decision": "deny", "policy": "approved-counterparties-only", "policy_version": 2, "reason": "Counterparty ACCT-90417 is not on the approved list for this workload. No approver can authorize this transfer.", "remediation": "use_an_approved_counterparty", "decision_id": "dec_01JQ8ZK7B4X2NH6D", "task_id": "tsk_9f31c2" }}
Full call-graphs. Nothing to instrument.
Every call already crosses the boundary you routed through, so the whole task reconstructs itself: model calls, tool invocations, and hand-offs to other agents, each with its verdict. You add nothing to your process. It works just as well for code you don’t own.
- Any framework, any language. If it can set a base URL or an MCP endpoint, it is governed and recorded.
- Multi-agent by default. A delegated hop stays inside the originating task, so the sub-agent’s actions are attributable to the work that authorized them.
- Ask the real question. “What did this agent do, and who authorized it?” resolves to a chained record set your auditor can recompute for themselves.
curl -X POST https://api.your-aegis.example/v1/workloads \ -H "Authorization: Bearer $AEGIS_TOKEN" \ -d '{"name": "invoice-agent", "owner": "finance-ops"}'# → 201 { "client_id": "wl_invoice-agent", "credential": "..." }
curl -X POST https://api.your-aegis.example/v1/policies \ -H "Authorization: Bearer $AEGIS_TOKEN" \ -d '{"name": "vendor-payments-require-approval", "rule": "Agents may pay approved vendors up to $5,000. Anything larger needs a human approver from Finance."}'# → 201 { "status": "compiled", "engine": "cedar",# "effect": "default-deny", "version": 1 }
Everything the console does, the API does.
Register workloads and issue their credentials, write policy in plain English and get deterministic, default-deny enforcement back, name the reviewers, read decisions, and provision whole governed environments — programmatically. The console is just another client of this API.
POST /v1/workloadsRegister an agent and issue its own credential.POST /v1/policiesAuthor in plain English; compiled to formally verifiable Cedar.GET /v1/decisionsQuery the chained decision record set by task, workload, or user.POST /v1/environmentsProvision a governed environment, end to end.
The whole integration is three steps.
No agent rewrite, no framework migration, no instrumentation pass across services you don’t own. What changes is where the traffic goes — and what happens to it there.
-
STEP 01
Register the agent
It gets an identity: a workload record and its own credential. From that moment every call it makes is attributable to it, and to the user and task it is acting for.
-
STEP 02
Route its traffic
One endpoint per protocol:
base_urlfor model calls, the MCP endpoint for tools, A2A for delegation to other agents. Your framework, models, and code stay exactly as they are. -
STEP 03
Author policy and reviewers
Write the rule in plain English. Aegis compiles it to deterministic, default-deny enforcement and applies it to every call, including the actions the policy says a named human has to approve.
Keep your framework · keep your models · keep your code
Point one agent at it and read the evidence.
Bring an agent you already run. Swap the base URL, write one policy, and read back exactly what it did — and who authorized every step of it.
OpenAI-compatible · MCP · A2A · Cedar · production deploys into your VPC