One control plane between your agents and everything they touch.
Every model call, tool call, and agent-to-agent hop gets an identity check, a deterministic policy decision, optional human approval, and a tamper-evident record.
llm:chat.completions · gpt-class
Allow
mcp:tools/call · billing.refund
held — above the $500 delegated limit
Hold
approve tsk_4f9c1a
Allow
a2a:tasks/send · out of task scope
Deny
Three gateways, each fluent in its own protocol.
They cover every way an agent reaches the outside world: an OpenAI-compatible endpoint for model calls, an MCP gateway with OAuth for tool calls, and A2A v1.0 in both directions for agent-to-agent work. Because each one parses what it carries, tool names, JSON-RPC methods, and A2A task states arrive as first-class policy attributes. A rule can turn on tools/call → billing.refund and the amount inside its arguments.
- Agents never hold upstream credentials. The keys to your models, tools, and downstream systems live at the gateway and are injected per call, scoped to the decision that authorized that call. The agent carries only its own identity.
- One uniform policy pipeline. Identity, decision, approval, and record run identically whichever protocol the traffic arrives on — no second rulebook for tools, no third for agents.
- No traffic bypasses it. Network egress rules make the gateways the only route out, so an unreviewed call never reaches a provider.
- Nothing to rewrite. Point your existing SDK at the endpoint and keep whatever framework the team picked.
Semantic Policies: write the rule, ship the enforcement.
Write the rule the way you would say it to a new hire. Aegis compiles it to Cedar — deterministic, default-deny, formally verifiable — and enforces the compiled artifact on every call your agents make out. What runs at request time is the rule you read and approved, in the form you approved it, and you can read it again a year later.
“Support agents may issue a refund of up to $500 for a customer who granted them that authority. Anything larger needs a human.”
permit (
principal in Aegis::Workload::"support-agents",
action == Aegis::Action::"mcp:tools/call",
resource == Aegis::Tool::"billing.refund"
)
when {
context.arguments.amount_usd <= 500 &&
principal.on_behalf_of.consent.scopes.contains("billing.refund")
};
// above 500 → the approval rule holds the task for a person
// anything not permitted here is deniedReproducible by construction. request 0x4c1e → ALLOW · refund-limit@v7 replayed → ALLOW · refund-limit@v7
- Anonymize
- Personal data is detected and replaced inline before the call leaves your boundary. The agent still gets a usable prompt; the provider never sees the original.
- Block
- The call stops at the gateway with a denial, and the record names the rule and the category of data that stopped it.
- Flag
- The call proceeds, marked. Reviewers get a queryable trail of exactly where sensitive data moved, and under which policy.
Every agent gets an identity — and it carries all the way to the task.
Aegis includes an identity provider built for non-human actors: OAuth 2.1 client credentials and short-lived JWTs issued per workload, with rotation and revocation you control. Identity here is a chain: organization, workload, the person who delegated, the task. Every decision is evaluated against the whole of it.
- Delegated user authority. An agent can act with a subset of a person’s authority, granted through explicit consent, bounded by scope, and named on every call it makes with that authority.
- Verified mDL attributes as policy conditions. A rule can require that a verified credential presented for this task carries specific attributes (issuing authority, credential validity, an age assertion) before the action is permitted.
- Task binding. Because the task is part of the identity, authority granted for one piece of work does not leak into the next one.
- Alongside what you already run. Your identity provider stays the source of truth for people. Aegis governs what agents do on top of it.
org_northwind
The tenant boundary. Policies, records, and approvals never cross it.
wl_support-agent
OAuth 2.1 client credentials and a short-lived JWT — rotatable, revocable, yours to govern.
usr_c.alvarez · consent: billing.refund
Acting on behalf of a person, inside the scopes that person granted. Verified mDL attributes are available as conditions:
- mdl.issuing_authority = CA DMV
- mdl.credential_status = valid
- mdl.age_over_21 = true
tsk_4f9c1a · state: working
The unit of work. Authority is scoped to it, and every record is chained to it.
Policy names the actions that need a person.
You write it into the rule instead of threading approval logic through every agent your team builds. When a rule calls for review, Aegis returns a hold: the triggering task pauses at the gateway while the rest of the fleet keeps working.
- The reviewer gets one card. Who is asking, under which policy, and exactly what the agent proposes to do, down to the arguments it intends to send.
- The agent never gets an error. The call simply hasn’t returned yet — no error path, no retry storm, no lost context. On approval the task resumes precisely where it paused.
- Scoped to the task. The other work in flight never learns about it.
- The approval is evidence. Approver identity, timestamp, and decision land on the same chain as the action they authorized.
{ "invoice": "INV-88214", "amount_usd": 1450.00 }
- tsk_4f9c1arefund · INV-88214held for review
- tsk_51b7e2invoice reconciliationworking
- tsk_51b8c0vendor lookup · A2Aworking
Evidence auditors verify, not logs they’re asked to trust.
Every decision writes a record, and every record is HMAC-chained to the one before it. Remove a record or edit a field and the chain stops verifying — the gap is detectable by an auditor, without taking anyone’s word for it.
- The full identity chain travels with the record. Organization, workload, the person whose authority was delegated, and the task, plus the policy id and version that produced the decision.
- Complete task call-graphs, zero agent instrumentation. Aegis reconstructs the whole tree at the gateway, from the first model call to the last hand-off. Nothing gets installed in the agent.
- Auditor-queryable. Query by task, by workload, or by the person whose authority was used, and every row comes back with a verifiable chain behind it.
- Stopped actions are on the record. A refused call gets a record of its own, naming the rule that refused it.
mcp:tools/call · billing.refund
policy refund-limit@v7 · approval required
Hold
approver identity written to the chain
Allow
tsk_4f9c1a support refund completed
├─ llm:chat.completions ALLOW 312 ms
├─ mcp:tools/call invoice.get ALLOW 88 ms
├─ mcp:tools/call billing.refund HOLD
│ └─ approved by usr_d.reyes ALLOW 34.5 s
└─ a2a:tasks/send ledger-agent DENY out of scopeRuns where your agents run — inside your boundary.
Aegis is self-hosted. It deploys into your VPC alongside the workloads it governs, and the material that makes governance meaningful (your policies, your decision records, your approval history) never has to leave.
Self-hosted by design
Deploy into your own cloud account and your own network. Governance sits where the agents already are.
Your data stays yours
Policies, decision records, and approval data live inside your boundary, under your retention rules and your access controls.
Control plane, enforcement plane
Authoring, compilation, and administration are separated from the enforcement path, so decisions stay fast and stay available.
The only path out
Network egress rules make the gateways the sole route to models, tools, and other agents. Coverage becomes a property of the network.
Bring one workflow you would not let an agent run unwatched.
We will write the rule with you in plain language, compile it, and put it in front of real traffic — so you can see the decision, the hold, and the record it leaves behind.