Aegis sits between AI agents and your company's tools. The model only asks. Deterministic code decides: permission, policy, human approval, exactly-once execution, and an audit row for every action.
One-click demo accounts · no sign-up
What runs for real on the public demo, and what is simulated.
An agent never calls Gmail, GitHub or Notion itself. It asks for a tool, and the request goes through one gateway that every call shares, native or MCP. The LLM is never the security boundary, so a prompt injection can change what the model wants, not what it is allowed to do.
Resolve, authorize, validate, policy, idempotency, execute, record, audit, return. A denied call is still recorded, because it is the proof that the guardrails worked.
The model only asked. Every decision here is plain, deterministic code.
01/12 Executive Assistant asks for notion.create_page
A replay of the Executive Assistant on the live demo. On the real thing the model picks its own path, so your run may read different sources. Try it and compare.
01/13 Maya asks the Executive Assistant
Idempotency keys are saved before the external call. Retries back off exponentially and reconcile first. A per-connection circuit breaker stops the agent from hammering a system that is down.
01/12 jira.create_issue (approved) · key saved as in_progress
The application writes the audit log insert-only. Policies are evaluated in a fixed order (explicit deny, permission, budget, risk, custom rules), so the same call always gets the same answer, and you can explain it to an auditor.
1{2 "name": "External drafts need review",3 "effect": "require_approval",4 "priority": 50,5 "condition": {6 "tool": "gmail.create_draft",7 "args.to": {8 "not_domain": "northwind.dev"9 }10 }11}
01/12 run.started · Executive Assistant
Agents are configuration (model, instructions, permitted tools, budget) on one shared runtime. Atlas is a separate product, reached only over MCP. MCP is the transport, not the boundary.
Which systems can it touch? Who approved that email? Why did it make 14 tool calls? Did the new model do better? What did we spend? Aegis has an answer for each one.
A risky call interrupts the LangGraph run and checkpoints it to Postgres. A reviewer approves, edits the arguments, or rejects with a reason, and any worker resumes the run, hours later if needed. Approvals expire, and an expired approval counts as a rejection.
MCP servers (streamable HTTP or stdio) are imported as ordinary tools with a risk level. They go through the same nine checks. Bearer tokens are encrypted and never logged.
Every LLM and tool call is a step with latency, tokens, cost and an error category, streamed to the trace over SSE as it happens.
Suites replay scenarios against mock tools in a sandbox. They score task completion, tool choice, argument correctness, unnecessary calls and policy compliance.
Fernet-encrypted at rest, with a rotatable keyring. The API is write-only: reads return a masked hint like ghp_…a1b2. Secrets never reach the model or the trace.
Per-agent cost caps are enforced by the policy engine, plus a per-agent, per-tool call cap (30 a minute by default). HTTP limits are counted in Redis per IP and per user.
Agents are configuration on one runtime. The provider layer supports Anthropic, NVIDIA NIM (directly or through any OpenAI-compatible gateway), the Claude CLI, or a deterministic mock. The UI always shows the model that really answered.
Admins, builders, approvers and viewers each see what their role allows. The API re-checks every action. The demo has one account per role.
Short answers from the architecture notes.
No. It is a showcase project by Kanav Chauhan: a complete, working governance layer, built to show how agents can act on real company tools safely. Nothing here is for sale, and there is no waitlist.
A model can be talked into anything: a prompt injection in an email can make it want to send that email to everyone. In Aegis the model can only ask. Permission, schema, policy, approval and idempotency are plain, deterministic code that the model can't skip.
Nothing reaches the external system. The agent gets a structured error such as POLICY_DENIED or PERMISSION_DENIED with the reason, and it adapts: it uses another source or tells the user. The denial is recorded in the trace and the audit log, because denials prove the guardrails work.
The run is a LangGraph graph. A risky call interrupts it, and the state is checkpointed to Postgres after every node. When someone approves, any worker picks the run up from that checkpoint. Approvals expire, and an expired approval is treated as a rejection.
NVIDIA Nemotron through NVIDIA NIM, via an AI gateway that falls back to Groq and then Cloudflare Workers AI. The agents keep their Claude model names so they run unchanged on the Anthropic API, and the UI shows the model that really served each step.
Not through the gateway. A write gets an idempotency key, sha256(run | tool | args), which is saved before the call. If the reply is lost, the retry first checks the target system for that key. A repeat of a finished action returns the stored result instead of running again.
Log in with one click as Maya (admin), Dan (builder), Priya (approver) or Sam (viewer). Run the Executive Assistant, approve or reject its actions, read traces, try policies and look at the audit log. Risky endpoints answer 403, runs are rate limited, and the data resets every night.
One click logs you in. No sign-up, and the demo data resets every night.