aegis — auditable intelligence governance contract

Deterministic, fail-closed governance
for AI model calls and workflows.

A Python SDK that enforces policy at the AI invocation boundary. Every model call is validated, every violation is blocked, and every outcome — pass or fail — leaves a tamper-evident audit artifact. Governance is runtime enforcement, not documentation and not prompting.

terminal — aegis install
$ pip install aegis-ai-governance==0.9.0b1
Public beta released from main and published on PyPI
Distribution: aegis-ai-governance · import/CLI: aegis
Installable now as aegis-ai-governance==0.9.0b1
$ python -c "import aegis; print(aegis.__version__)"
0.9.0b1
$
v0.9.0b1 is the aegis-ai-governance public beta — invocation and workflow governance, GovernanceSession, and the aegis workflow CLI. The package and live demo are released from main.

Where AEGIS lives

AEGIS sits at the invocation boundary between the host application and the model provider. Ownership is explicit and non-negotiable: the host orchestrates and calls the model; AEGIS governs and audits every invocation attempt.

// host.application
  • Orchestration logic
  • Transport & retries
  • Credentials & auth
  • Business state
  • Tool execution
  • Provider SDK usage
  • Model call issuance
// aegis.sdk
  • Policy loading & composition
  • Ordered governance gates
  • Role / schema / tool validation
  • Pre/postcondition enforcement
  • Workflow constraints
  • Evidence correlation
  • Tamper-evident audit artifacts
  • Risk scoring
  • Optional adapter normalization
// model.provider
  • Anthropic
  • OpenAI
  • AWS Bedrock
  • Any other provider
AEGIS is model-agnostic and provider-agnostic.
No provider SDK is required by AEGIS itself.
⊘ NOT a hosted platform

AEGIS does not own orchestration, transport, retries, credentials, business state, tool execution, or provider SDK usage. It is not a hosted orchestrator, model-serving platform, queue runner, transport layer, credential broker, or remote session manager.

If a model call cannot be justified by policy and evidenced by an audit record, AEGIS treats it as invalid. That is the entire surface.

// unified.mode

enforce_invocation() or AEGIS.enforce() — runs the complete gate sequence in one call. Input and output are provided together. Simple integration path for non-latency-sensitive cases.

v0.9.0b1 public beta
// split.mode

enforce_pre_call() authorizes before token spend. enforce_post_call() validates output after the model responds. The host model call lives between the two phases. Split mode is the @governed default since v0.3.3.

split-by-default

The enforcement pipeline

Every invocation traverses a fixed, ordered gate sequence. No step is skipped. A violation at any gate is fail-closed — the invocation is rejected and a FAIL artifact is emitted.

authorization side
load_policy()
YAML load, JSON Schema validation, extends composition, policy dates
Custom gates pre_authorization
User-supplied EnforcementGate plugins, first insertion point
evaluate_guards()
AST-based guard and condition resolution against invocation context
validate_role()
Role must appear in the policy allowlist; fails closed if absent
validate_preconditions()
Typed constraints — type, pattern, enum, min/max — on input fields
validate_tool_constraints()
Tool allowlist and block-list enforcement
Custom gates post_authorization
Second insertion point — host model call can now occur
output side
Custom gates pre_output
Third insertion point, before schema validation
validate_schema()
Output JSON Schema validation; fail-closed on mismatch
validate_postconditions()
Typed constraints applied to output fields after generation
Custom gates post_output
Fourth insertion point — final custom logic before risk
compute_risk_score()
Factor-based scoring; strict / risk_scored / warn_only modes
generate_audit_artifact()
SHA-256 checksums, optional HMAC-SHA256 signing, timestamp, risk score, PASS/FAIL verdict
# unified enforcement — quick start
from aegis import enforce_invocation

# Assemble the invocation. AEGIS validates;
# the host owns the model call.
artifact = enforce_invocation({
    "policy_file":       "policies/base_policy.yaml",
    "model_provider":    "anthropic",
    "model_identifier": "claude-sonnet-4-6",
    "role":             "assistant",
    "input":  {"query": "Summarize this incident"},
    "output": {"result": "...", "confidence": 0.94},
    "context": {
        "role_declared": True,
        "schema_exists":  True,
    },
})

# artifact.verdict → "PASS" or "FAIL"
assert artifact.verdict == "PASS"
# instance API — isolated config
from aegis import AEGIS, JsonFileAuditSink

engine = AEGIS(
    sink=JsonFileAuditSink("audit.jsonl")
)
artifact = engine.enforce(invocation)
// policy format

Policies are YAML validated against schemas/policy_dsl.schema.json (Draft-07). Key fields: policy_version, roles, pre_conditions, post_conditions, output_schema, tools, guards, risk, composition_strategy.

policy_dsl_spec.md

Authorize before you spend

Split enforcement separates the authorization pass from output validation, letting hosts block invalid requests before any tokens are consumed. Since v0.3.3 this is the @governed default.

Phase A — Pre-Call Authorization
load_policy()
evaluate_guards()
validate_role()
validate_preconditions()
validate_tool_constraints()
custom pre/post_authorization gates
→ AUTHORIZED — PreCallResult issued
→ BLOCKED — FAIL artifact emitted
HOST
model call
owner: host
Phase B — Post-Call Validation
validate signed PreCallResult evidence
custom pre_output gates
validate_schema()
validate_postconditions()
custom post_output gates
compute_risk_score()
generate_audit_artifact()
→ PASS artifact emitted
→ FAIL artifact emitted
# split enforcement — function API
from aegis import enforce_pre_call, enforce_post_call

# Phase A — runs before token spend
pre = enforce_pre_call({
    "policy_file":      "policies/base.yaml",
    "model_provider":   "anthropic",
    "model_identifier":"claude-sonnet-4-6",
    "role":            "assistant",
    "input":           {"query": "Summarize incident"},
    "context":         {"role_declared": True},
})
# pre.authorized → True/False

# Host owns the model call
output = model.generate(pre)

# Phase B — validates output
artifact = enforce_post_call(pre, output)
# @governed decorator — split-by-default
from aegis import governed

# pre_call_enforcement=True is now the default
# since v0.3.3. Phase A runs before the function body.
@governed(
    policy_file="policies/base.yaml",
    role="assistant",
    model_provider="anthropic",
    model_identifier="claude-sonnet-4-6",
)
def run_model(input_data, context):
    return model.generate(input_data)
// security hardening — v0.3.2
  • Phase B validates signed evidence from Phase A, not mutable token state
  • Gate manifest verified against signed evidence bytes
  • Replay via cloned tokens blocked by process-local consumption tracking
  • FAIL artifact identity sourced from verified evidence, not caller input

Multi-step workflow governance

PUBLIC BETA: v0.9.0 workflow governance is packaged as aegis-ai-governance==0.9.0b1 and published on PyPI from the protected main release source. No external API keys required for the default first-adopter path.

The v0.9.0 beta adds session-scoped governance over multi-step AI workflows. AEGIS.open_session() returns a GovernanceSession context manager that enforces deterministic lifecycle state and produces correlated workflow artifacts.

# workflow — minimal starter
from aegis import AEGIS

# No module-level open_session().
# Always instance-scoped.
engine = AEGIS()

with engine.open_session(
    workflow_id="incident-review",
    policy_file="governance/policy.yaml",
) as session:

    # Step 1 — pre-call authorization
    pre = session.enforce_pre_call({
        "role": "assistant",
        "input": {"query": "Summarize"},
    })

    # Host owns the model call
    output = model.generate(...)

    # Step 1 — post-call validation
    pre.complete(output)

    # Step 2 ...

# Clean exit → COMPLETED workflow artifact
# Exception exit → FAILED + re-raise
Starter scaffolds: minimal, standard, regulated-high-assurance — generated by aegis workflow init --profile <name>. All compile to ordinary session + policy + manifest behavior.
OPEN PAUSED | FAILED | COMPLETED | CANCELED FINALIZED

FINALIZED is a lifecycle state only — never serialized as artifact status. Artifact status values: COMPLETED, FAILED, CANCELED, INCOMPLETE.

// workflow CLI commands (v0.9.0 beta)
aegis workflow init --profile minimal
Generates starter scaffold in governance/
aegis workflow lint
Syntax, schema, and structural checks on workflow config
aegis workflow doctor
Diagnoses artifact and starter health; emits reason codes
aegis workflow trace
Reconstructs invocation timeline from session artifacts
aegis workflow export
Operator and audit export modes for session evidence
aegis policy init
Bootstraps a new policy YAML from a profile template
// key reason codes
  • WORKFLOW_INVALID_TRANSITION
  • WORKFLOW_APPROVAL_REQUIRED
  • WORKFLOW_SOURCE_REQUIRED
  • WORKFLOW_TOOL_BUDGET_EXCEEDED
  • WORKFLOW_SESSION_TOKEN_INVALID
  • WORKFLOW_STARTER_INTEGRITY_ERROR

From install to governed workflow

The canonical first-adopter path through v0.9.0-beta. No Bedrock, A2A, or OpenAI Agents SDK required.

step 01 — install
Install the v0.9.0b1 public beta
Install the published, pinned distribution from PyPI.
pip install aegis-ai-governance==0.9.0b1
step 02 — workflow init
Scaffold a starter profile
Run aegis workflow init --profile minimal. A governance/ directory is created with policy.yaml, workflow_example.py, and a manifest.
aegis workflow init --profile minimal
step 03 — first PASS
Run the generated example
Execute python workflow_example.py from inside governance/. Expect Status: COMPLETED, a session UUID, and a PASS audit artifact on disk.
python workflow_example.py → Status: COMPLETED
step 04 — inspect evidence
Read the audit artifact
Open the emitted .jsonl artifact. Verify checksums, verdict, session correlation, and provenance metadata. Use aegis workflow trace to reconstruct the timeline.
aegis workflow trace --session <uuid>
step 05 — trigger failure
Intentionally violate the policy
Modify the example to use a role not in the policy allowlist, or supply an input that fails a precondition. Run again. Observe a FAIL artifact with a typed reason code.
Status: FAILED → reason: ROLE_VIOLATION
step 06 — doctor & lint
Diagnose with workflow doctor
Run aegis workflow doctor to get human-readable diagnosis of the failure. Run aegis workflow lint to check the policy and workflow config for structural issues.
aegis workflow doctor → [FAIL] ROLE_VIOLATION: 'auditor' not in allowlist
step 07 — fix & verify
Repair and re-run to PASS
Add the role to the policy allowlist. Re-run. Confirm the artifact shows PASS. Inspect the correlated invocation IDs in the workflow artifact.
Status: COMPLETED → governance restored
// first-adopter docs (read in order)
1. Workflow Quickstart
2. Migration Guide
3. Troubleshooting
4. Starter Recipes
5. Workflow CLI Reference
6. Public API Contract
7. Supported Environments
8. Operations Runbook
9. External Adapter Docs (last)
adapters are advanced follow-on surfaces, not required for first success

Hands-on: the v0.3.x runtime

Eleven labs walk you through every major capability in the shipped runtime. Each lab runs against a live FastAPI backend — no mocking, no fake responses. Use the lab cards below to jump directly to a specific topic, or open the full demo.

🔒 nealsolves.github.io/aegis/
// jump to a specific lab
// live demo — technical notes

The demo runs against a permanent FastAPI backend. All 11 labs make real API calls — no mocked responses, no pre-baked results. Labs 1–10 cover v0.3.x capabilities from the shipped PyPI release. Lab 11 covers the v0.9.0-beta workflow governance surface.

↗ open in new tab

Tamper-evident evidence, always

One invocation, one artifact. Every governance outcome — pass or fail — is recorded with canonical checksums. Artifacts can be signed, chained, exported, and inspected offline.

audit.artifact — schema v1.4 — JSONL ● PASS
"schema_version":"1.4",
"verdict":"PASS",
"model_provider":"anthropic",
"model_identifier":"claude-sonnet-4-6",
"policy_version":"1.0.0",
"role":"assistant",
"risk_score":0.12,
"input_checksum":"sha256:3d2f1a...",
"output_checksum":"sha256:8e9c4b...",
"signature":"hmac-sha256:f2a91c...",
"provenance":{
"source_ids":["doc-42", "doc-17"],
"derived_from_audit_checksums":["sha256:aa1f2b..."]
},
"timestamp":"2026-04-28T14:22:03.814Z"
One artifact per invocation attempt
Invocation artifacts are not merged, updated, or replaced. One attempt → one PASS or FAIL record. Workflow evidence is separate and does not replace invocation artifacts.
SHA-256 + HMAC-SHA256 signing
Canonical checksums of input and output are computed and stored. Optional HMAC-SHA256 signing allows offline tamper detection. Verification is constant-time.
AuditLineage — invocation DAG
Reconstruct a directed acyclic graph of governed invocations from a JSONL audit trail. Traverse ancestors and descendants, detect orphans and cycles. Shipped in v0.3.3.
ProvenanceGate + RiskHistory
ProvenanceGate blocks output when source context is absent. RiskHistory tracks risk scores over time and flags improving, stable, or degrading trajectories.
// workflow-correlated artifacts (v0.9.0 beta)

In workflow mode, invocation artifacts gain additive workflow-correlation metadata (session_id, step_id, participant_id). Raw external payloads are not persisted by default. Workflow/session evidence is a separate artifact, not a replacement for per-invocation artifacts.

one artifact per invocation attempt
correlation metadata is additive only

What ships in the wheel

The installable runtime SDK is the Python package under aegis/. Everything else in the repository is documentation, demo, test, or maintainer material and is not required for runtime use.

⬡ Runtime wheel — aegis/ package
📁 aegis/__init__.py stable public exports
📄 aegis/enforcement.py public entry points
📄 aegis/decorators.py @governed surface
📄 aegis/sinks.py audit sinks
📄 aegis/session.py v0.9.0-beta workflow
📄 aegis/workflow_trace.py v0.9.0-beta trace
📄 aegis/workflow_export.py v0.9.0-beta export
📄 aegis/openai_agents_adapter.py aegis-ai-governance[openai-agents]
📁 aegis/_internal/ private, required
📁 aegis/schemas/ runtime JSON schemas
📄 aegis/py.typed PEP 561 marker
○ Repo / supporting — not in runtime wheel
📁 docs/ documentation
📁 tests/ test suite
📁 scripts/ maintainer scripts
📁 examples/ migration examples
📁 demo-app-react/ live demo UI
📁 demo-app-api/ demo FastAPI backend
📁 policies/ example policies
📁 schemas/ (top-level) human-facing copies
📁 graphics/ README imagery
📁 build/  .egg-info/  __pycache__/ generated
// critical rule — public import boundary

Host code must never import from aegis._internal. The _internal package is private by convention and required by public modules, but it is not a stable API surface. All public exports are available from aegis directly.

# ✓ correct
from aegis import enforce_invocation, AEGIS, governed

# ✗ never do this in host code
# from aegis._internal.enforcement import ...

Advanced ecosystem integrations

Optional adapters normalize provider-specific trace formats and agent protocols into AEGIS evidence. They are advanced follow-on tracks — not required for the default first-adopter path.

OpenAI Agents SDK
v0.9.0b1 public beta aegis-ai-governance[openai-agents]
Normalizes host-owned openai-agents run, interruption, and optional trace evidence. Governed tool support requires adapter-managed wrappers. Included in the v0.9.0b1 public beta under aegis.openai_agents_adapter.
Not re-exported from top-level aegis. Requires the openai-agents install extra. Unsupported runtime surfaces reject explicitly — no silent fallback.
AWS Bedrock Trace
v0.9.0b1 public beta
Normalizes host-supplied parsed Bedrock trace parts into AEGIS evidence. Alias-backed identity required for governed binding. Name-only evidence is insufficient when policy requires authoritative identity.
Included as aegis.bedrock_adapter; no AWS SDK is required by the base install.
A2A Protocol
v0.9.0b1 public beta
Normalizes parsed Agent Card, request metadata, and task envelopes. Validates supportedInterfaces[].protocolVersion. Accepts only normative TASK_STATE_* wire values. gRPC is out of scope for v0.9.0.
Included as aegis.a2a_adapter; no A2A SDK is required by the base install.
default path first — adapters last

The first-adopter docs order puts adapter documentation last for a reason. Completing the local minimal-starter golden path — install → init → PASS → failure → doctor → fix → PASS again — requires none of these adapters. Add adapter complexity only after the default path is working and understood.

Ready to govern your model calls?

Install the SDK, read the quickstart, and run a local workflow starter. No external services, no API keys, no platform account.

terminal — quick start
$ pip install aegis-ai-governance==0.9.0b1
Public beta available from PyPI
$ aegis workflow init --profile minimal
Created governance/ with minimal starter
$ python governance/workflow_example.py
Status: COMPLETED   Steps: 2   Session: <uuid>
1
pip install aegis-ai-governance==0.9.0b1 — install the public beta
2
Read docs/reference/WORKFLOW_QUICKSTART.md — first-adopter path
3
Run aegis workflow init --profile minimal — scaffold and execute