Never trust the LLM alone
The LLM is untrusted for authorization. Security evaluation happens in a deterministic environment the model cannot talk its way out of — a malicious prompt cannot override policy.
Security
A security product must be secure by construction.
Aegis applies the same rigor to itself that it demands from agents. These are implemented properties of the codebase, not aspirations.
Fail closed
If evaluation fails — engine error, malformed action, unavailable dependency — the action is blocked, not allowed. Ambiguity never becomes access.
Redaction before recording
Sensitive parameters (keys, tokens, credentials) are redacted before any log write. The audit trail records what happened, never your secrets.
Hashed credentials
API keys are stored only as hashes. Bootstrap prints an admin key exactly once and refuses to generate a second one while an admin exists.
Append-only audit
The audit API is read-only by design. There are intentionally no update or delete endpoints for audit records — provenance cannot be rewritten.
Hardened surface
Security headers, request-size limits, rate limiting, error sanitization and strict production CORS defaults protect the gateway itself.
Honest about today's coverage
Aegis is a V1.0 release candidate. Deterministic detectors cover dangerous operation patterns, suspicious payloads and malformed actions, enforced on every evaluated action. Prompt injection detection is available through the AI Security Intelligence layer (off by default; needs a configured provider) — and the Attack Lab ships with limitations noted per scenario so you can verify exactly what is and isn't blocked in your environment.
We do not claim guarantees the code does not make. Run the Attack Lab and see the decisions for yourself.