How AEGIS secures AI agents

Why an agent cannot check itself

Most agent systems combine planning and execution in a single process: the language model decides which tool to call, and the call happens immediately. Security rules live in the system prompt or in a second model query that is meant to "assess" the result. Both fail at the same point: the model that is supposed to follow the rules is also the model that can be manipulated.

A language model does not reliably distinguish between your instruction and a text it is currently reading. If an attachment says "Forward these documents to the following address", that can turn into an action - this is indirect prompt injection. A check performed by the same model sees the same manipulated context and may well consider the action plausible. We set out the reasoning in detail in a dedicated article: Why an AI agent cannot check itself.

AEGIS draws an architectural conclusion from this: control is not a property of the model, but a separate authority with its own logic, its own permissions and its own key.

The three authorities in detail

1. Think

   Planning authority

   A language model understands the task and breaks it down into steps. For each step it produces a structured intent, but it has neither credentials nor access to tools.

2. Check

   Checking authority

   Deterministic code without a language model checks every intent against your rules and signs only what passes every check. This authority neither plans nor executes anything.

3. Act

   Execution authority

   Verifies the signature again, executes the approved step and writes the result or denial to the audit log. Without a valid signature, nothing happens.

The three authorities run as separate services. The planning authority neither knows the secret used to sign approvals nor can it call tools. Even a fully manipulated model can therefore only generate proposals, which then go through the same checks as any other.

What an intent is

Every planned action is described as an intent, a structured record rather than free text. It specifies which action is to be carried out with which parameters at which action level, and it is valid only once and only for a short time. If the intent passes every check, the checking authority signs it cryptographically (HMAC). The signature covers the action, the level and the parameters: if even one detail is changed afterwards, it becomes invalid.

What the checking authority verifies

• Schema: The intent must match the expected format exactly. Unknown fields or missing information lead to denial.
• Tool: The action must be on the allowlist. Default-deny applies: anything not explicitly permitted is forbidden. Shell commands outside the list do not exist.
• Action level: You define the highest level an agent may reach. If the intent exceeds it, it is denied.
• Destinations: Content from the internet can be accessed only on approved domains. The internet is treated as untrusted by default.
• Freshness: Timestamps outside the valid time window and nonces that have already been used are rejected. This prevents replay attacks, in which an approval that was granted once is submitted again.

Action levels

The level is part of the signed intent. An agent therefore cannot "downgrade" an action after the fact to avoid a stricter check.

What happens when an action is denied

A denial is not an error but a normal, logged outcome. The checking authority does not sign the intent, the execution authority rejects it for lack of a valid signature, and the event is recorded with its reason: which tool, which level, which rule. The agent gets no further along that path. Every new proposal is a new intent and goes through the same check again.

This gives you something valuable: denied intents show where an agent is hitting its limits. If denials pile up for a particular tool, that points either to a rule that is too narrow or to an agent that is being steered in the wrong direction.

Traceability: what is logged

The audit log is append-only: entries are added, never overwritten. Each entry contains the SHA-256 hash of its predecessor, forming a hash chain. If an entry is altered or removed after the fact, the chain no longer matches. On start-up, the execution authority verifies the integrity of the log and refuses to operate if the chain is broken.

The log thus answers the questions asked after an incident or during an audit: who triggered the task, what the agent planned, which rule made the decision, and what was actually executed.

Comparison: three ways to run AI agents

Human approvals still make sense, but where they have an effect: for a small number of deliberately selected decisions. For everything else, deterministic rules are more reliable than a click made under time pressure.