The Aegis Engine

Control, visibility, and safety over your AI agents.

One gateway in front of your models and tools. Deterministic rails on every prompt and response, and an execution rail that authorizes whether an agent's action runs at all.

Request pilot access Jump to the execution rail
aegis / policy: financial-ops enforcing
search_knowledgebase Allow scope: read · 9.4 ms
fs.read /etc/shadow Deny least-privilege-path · 10.8 ms
wire_transfer $250,000 Held dangerous-fund-wire · 12.6 ms
tool result: support_ticket Blocked indirect-injection · 11.2 ms

Illustrative example decisions. Per-call latencies vary by rule; the measured p95 figures are on the benchmarks page.

Guaranteed Protections

Everything the gateway enforces at runtime.

Deterministic enforcement measured in milliseconds, in-process — safety is never left to model compliance.

Prevent Destructive Agent Actions

Agents can delete records, move money, or call private endpoints. Aegis inspects every tool and MCP call against policy and blocks unauthorized actions before they execute — not after the damage is logged.

Block Advanced LLM Attacks

Deterministic input and output rails catch prompt injection, indirect (data-borne) injection, jailbreaks, goal hijacking, and tool poisoning without model round-trips.

Versioned, Immutable Policies

Express your guardrails as first-class policies with immutable versions and clean rollback. Assign the right policy per tenant or environment without redeploying your codebase.

Proven Tenant Isolation

Serve thousands of teams or customers from one gateway. Every read and write is scoped to its tenant at the access layer, API keys are hashed and revocable, and a 28-probe adversarial matrix found zero cross-tenant leakage.

Granular Least-Privilege Scopes

Grant each agent only the tools and filesystem paths it genuinely requires, dramatically shrinking the blast radius of a compromised prompt or poisoned document.

Mask It, Don’t Fail It

Blocking is the wrong action for most data-loss cases. Aegis masks payment cards, national IDs, bank details and credential material in tool results and model output — format-preserving, so the turn completes and downstream logic still works.

Policy That Knows Who

Bind rules to the end user and their groups, not just the tenant — so finance gets a higher refund ceiling than support. An asserted identity can only ever narrow the policy unless the calling key is explicitly trusted to broker identity.

The Chain, Not The Step

Read a customer file, summarise it, mail it out. Every step is legitimate; only the sequence is the attack. Aegis scores sessions across turns for that escalation chain, tool fan-out and block ratio — and can enforce on it.

Shadow AI, From Inside

A scanner sees what is registered. Sitting in the request path, Aegis sees what is used — and can tell you which MCP server is being called forty times a day that nobody put on your allow-list.

Red-Team Your Own Policy

Run our adversarial probe pack against your active policy, in-process, generating no traffic. You get the verdicts the rail would actually return — with coverage and false-positive rate, because a policy that denies everything scores 100% on one of those.

Erasure Without Breaking Proof

An append-only, hash-chained audit log and a right-to-erasure request are usually a contradiction. Personal data in audit payloads is sealed under a per-subject key; erasure destroys the key. The plaintext is unrecoverable and the chain still verifies.

Attributable Explainability

Every agent decision, tool call, and policy verdict is recorded in real time and tagged with the exact ruleset version that produced it for reproducible audits.

Compliance Ready Evidence

Immutable, exportable audit logs and reports mapped directly to the OWASP LLM Top 10, the EU AI Act, NIST AI RMF and MITRE ATLAS give security teams defensible proof.

Zero SDK Rewrites

Point your existing OpenAI-compatible client at Aegis — change the base URL and API key, nothing else. Streaming tool calls are fully supported.

Tool-Result Poisoning Defense

Data returned from external tools is untrusted. Aegis validates tool outputs for indirect injection and leaked credentials before the LLM consumes it.

System Architecture

A runtime firewall in front of your model — and your tools.

Every request passes through the rails; every tool and MCP call is verified against deterministic policy before execution.

Integration path

Your existing client keeps its code — it just points somewhere safer.

2-line change
Your Code unchanged SDK
  1. Base URL point the client at the Aegis gateway
  2. API Key an Aegis key replaces the provider key
  3. Same Contract identical request and response shapes
  4. Frameworks LangChain · CrewAI · AutoGen
Guarded Traffic every call on the rail

Streaming tool calls are supported end to end — no agent refactor, no proxy sidecar to operate.

Enforcement plane

Four deterministic stages stand between the agent and anything it can touch.

14 ms p95, in-process
Your Agent OpenAI-compatible
  1. Input Rails prompt injection & jailbreak detection
  2. Tool Guard allow, deny and scope every tool call
  3. Result Check tool-result poisoning defense
  4. Output Rails data-loss prevention & safety
Model & Tools LLMs · MCP servers

The first check that denies halts the call — nothing downstream runs. Every decision is attributed to a versioned rule and recorded in a tamper-evident audit trail.

Model & infrastructure

Only calls that clear every rail reach a provider — and the way back is inspected too.

Any provider
Verified Call verified by the rail
  1. LLM Providers OpenAI, or any OpenAI-compatible endpoint — including Anthropic and Gemini compatibility layers
  2. MCP Servers remote and self-hosted tool servers
  3. Local Tools filesystem, shell and internal APIs
  4. Streaming buffered, verified, then released
Audited Response hash-chained evidence

Swap models or add an MCP server without touching policy — the same rules apply to whatever sits behind the rail.

Deterministic Enforcement

Six sequential checks on every tool and MCP call.

Each tool call evaluates a strict precedence chain. The first check that denies halts execution immediately, attributing the decision to a versioned rule.

  1. 01

    Name Deny-List

    Explicitly forbidden tools are halted first. Tool names are canonicalized before matching, preventing Unicode look-alikes, whitespace variations, and homoglyphs from bypassing policy.

  2. 02

    Default Deny Posture

    Under default-deny mode, any tool call not on the verified allow-list is refused. This prevents hallucinated or newly injected tool names from executing.

  3. 03

    Least-Privilege Constraints

    Per-tool path allow/deny lists, argument length boundaries, and forbidden substrings. Directory traversal, percent-encoding, and path normalization are resolved before comparison.

  4. 04

    Dangerous-Action Detection

    Detects funds movement, audit-log modification, and administrative privilege elevation by inspecting the tool name and arguments together as a single semantic action.

  5. 05

    Dangerous-Argument Scan

    Scans arguments for destructive shell commands, raw SQL injection, privilege escalation tokens, and credential material hidden inside nested JSON structures.

  6. 06

    Tool-Result Validation

    Incoming tool outputs are checked for indirect prompt injection, data exfiltration triggers, and leaked secrets before the LLM processes the result.

Operator Visibility

Every decision, visible and attributable in real time.

The operator console provides live traffic visibility per tenant — volume, block rate, guardrail latency, fired rules, and active agent tools — with a running stream of attributed decisions.

🛡 Aegis Enterprise Console tenant: prod-finance-agent • role: sec-admin Live • 1h Runtime Radar & Enforcement Dashboard 1,429REQUESTS 184BLOCKED 12.8%BLOCK RATE 14msP95 TOOL GUARD 842TOOL CALLS 64TOOLS HELD DECISION TRAFFIC TIMELINE (REQUESTS VS BLOCKS) 1,429 evaluated • 184 blocks • 12.8% block rate • sample tenant data TOP FIRED RULES TOP INTERCEPTED TOOLS OWASP LLM THREAT CATEGORY dangerous-fund-wire48 least-privilege-path39 indirect-injection34 jailbreak-attempt28 execute_bash52 transfer_funds48 fs.read39 delete_table18 LLM06: Excessive Agency87 LLM01: Prompt Injection62 LLM02: Data Disclosure24 LLM08: Vector & Tool Poison11
Illustrative view of the Aegis operator console. Latency figures are measured on our benchmark suite — 2.9 ms p95 on the prompt and response rails, 14 ms p95 for full tool and MCP inspection. Request volumes and rule counts are sample data.
Comparison

Posture platforms find your agents. Aegis stops one.

Most AI security platforms discover, score, and test the agents you already run. Aegis is the control point in the request path that decides whether an action executes. Most teams end up needing both — here is the honest split.

Security & operational capability AI security posture platforms Aegis enforcement plane
Agent, model & MCP server discovery Yes — scans your estate Derived from traffic, not scanned
Automated red teaming & attack simulation Yes — broad simulation Probe pack against your own policy
Data masking & redaction as an action Yes Yes (format-preserving, deterministic)
Direct prompt injection & jailbreak defense Yes Yes
Runtime tool & MCP call interception Yes Yes (pre-execution)
Per-argument least-privilege constraints Partial (tool level) Yes (paths, limits, destinations)
Identity-aware policy (end user & group) Yes (IdP groups) Yes — and it can only narrow
Cross-turn behavioural detection Yes Yes (read → sensitive → send)
Tool-result poisoning inspection Partial Yes
Incident triage & investigation queue Yes Yes
Non-English attack coverage Model-based, broad 13 named languages, published
Streaming tool-call buffering & verification Not documented Yes
Decision engine Model-based (adaptive) Deterministic, in-process
Published, measured latency budget Sub-50 ms, network hop 2.9 ms rails · 14 ms tool guard
Tamper-evident hash-chained audit trail Partial (audit logs) Yes (verifiable chain)
Decisions attributed to an immutable policy version Partial Yes
Framework-mapped compliance reporting Yes OWASP · EU AI Act · NIST · ATLAS
Right to erasure over an immutable audit log Not documented Yes — crypto-shredded, chain intact
Native SIEM streaming (CEF/syslog & NDJSON) Yes Yes
Self-host in your own VPC or on-premise Some vendors Yes

Compared against the publicly documented capabilities of the leading AI security posture platforms, reviewed August 2026. A capability a vendor does not describe publicly is marked not documented rather than absent. Aegis figures are measured on our own benchmark suite.

Test Aegis against your most complex agent.

Design-partner pilots include full onboarding, custom tool policy configuration, and private deployment support.

Request pilot access Explore security architecture