Discovery finds agents and AI tools without anyone registering them, in your clouds, SaaS apps and on employee laptops. Policy decides before risky actions run, inside your agents and on laptops. Every decision is recorded as evidence.
Agents live in cloud functions, containers, GPU machines, model platforms and SaaS apps. Cloud scanners miss the ones configured inside your CRM or service desk.
Outcome: an inventory you can defend, with owners to assign and risks you can explain to an auditor.
A model can be talked into actions nobody intended, and reviewing configuration can't stop a call at runtime.
Outcome: every consequential action gets a decision before it happens.
One client, then wrap each tool (Python)
from aegis import Aegis, aegis_guard
client = Aegis(api_key="…", auto_instrument=True)
@aegis_guard(client, agent_id="ops-agent",
tool_name="slack.post_message")
def post_to_slack(channel, text): ...
# a blocked call raises ForbiddenErrorA policy, in plain YAML
tools:
- id: crm.issue_refund
params:
- field_name: amount
conditions: [{type: range, range: {min: 1, max: 25000}}]
limits: {qps: 2, approval_threshold_usd: 5000}
approval_config: {approve_count: 2}When policies disagree: block always wins → hold then a person decides → mask fields rewritten → allow only if nothing objected.
What your code sees for each decision, latency and failure behaviour →
Most agent permissions are guesses. Broad access stays because nobody knows what the agent needs.
Outcome: least privilege you can defend, drafted from what agents actually do.
| Before | After |
|---|---|
| iam:* · never used in 90 days | Removed via pull request |
| s3:GetObject on every bucket | refund-attachments/* only |
| Any tool the code can reach | crm.issue_refund only |
| Any amount | $1 to $25,000 |
| No approval | Over $5,000: two approvers |
| No rate limit | 2 calls per second |
Illustrative. You approve the change set; IAM changes ship as a pull request.
Sensitive data can leave through the tool calls agents make, and auditors want to know which control acted.
Outcome: sensitive values stay where they belong, and audit answers come from records.
| Runtime event | AIUC-1 evidence |
|---|---|
| block | B006, D003 |
| mask | B005, B009, A006 |
| hold for approval | C007, C009 |
| personal data redacted | A006 |
| credential redacted | A008 |
| open mode used | Recorded as a gap, never as evidence |
Evidence relevant to a requirement, not a certification. AIUC-1 certification is a vendor-side process with accredited auditors.
Employees use AI apps, browser extensions and coding agents that never went through review, and paste customer data into them.
Outcome: one inventory of AI use across agents and people, and sensitive data kept out of unapproved tools.
Outcome: a clear answer with evidence behind it.
Outcome: a control point you can review, test and reason about.
Outcome: evidence, not screenshots.
Outcome: ship agents that pass the security review.
Financial services, insurance and healthcare run agents that touch money and personal data. Aegis puts a decision and a record on each of those actions.
Cap refund and payout amounts, lock currencies to allowed values, and require two approvers above a threshold.
Hold actions that change a customer record for human review, with the exact parameters in front of the approver.
Mask identifiers such as SSNs, emails and phone numbers before a tool call leaves the agent, and before an employee pastes them into an AI tool.
Need it inside your own network? Aegis also runs as a single-tenant appliance in your environment.
Ask about on-premWe would rather you hear it from us.
A 30-minute walkthrough: discovery, a live policy decision, and the evidence behind it.