Acacian/aegis

The governance layer for AI agents. One API, 12 frameworks, every governance primitive.
Aegis is to agent governance what Redis is to data structures — one runtime that unifies prompt-injection blocking, PII masking, policy enforcement, trust delegation, and tamper-evident audit across every agent framework. No code changes.
pip install agent-aegis → aegis.auto_instrument() → 12 frameworks are now governed.
What is Aegis •
Primitives •
Frameworks •
Use Cases •
30-Second Start •
Research •
Docs •
Playground
English •
한국어
---
---
What is Aegis
Every AI agent framework reinvents the same governance primitives — and each one does it slightly differently. Aegis is the abstraction layer that unifies them.
| Layer | What it does | Examples |
|-------|-------------|----------|
| **1. Primitives** | A universal contract for every tool call | Action, ActionClaim, Policy, Result, DelegationChain, AuditEvent |
| **2. Adapters** | Auto-instrument any framework through its own hooks | LangChain callbacks, CrewAI BeforeToolCallHook, OpenAI Agents tracing, Google ADK BasePlugin, MCP transport, DSPy modules, httpx middleware, Playwright context |
| **3. Governance** | Declarative primitives you compose into policy | Prompt injection / PII / leak / toxicity guardrails, RBAC, rate limit, cost budget, drift detection, anomaly scoring, trust delegation, justification gap, selection audit, Merkle audit chain |
| **4. Lifecycle** | One runtime, every stage of agent ops | Scan → Instrument → Policy CI/CD → Runtime → Proxy → Audit |
You don't write a LangChain guardrail and a CrewAI guardrail and an OpenAI guardrail — you write one Policy and every framework inherits it.
How this differs from the guardrail libraries
They solve a different problem, and mostly a text-shaped one. Guardrails AI validates model output against a hub of validators; NeMo Guardrails scripts conversational and tool policy in the Colang DSL; Snyk Agent Scan — Invariant Labs' mcp-scan, since the Snyk acquisition — scans MCP servers and agent skills for known risk patterns and can proxy them at runtime; LLM Guard chained input/output scanners until it was archived in July 2026. Each one you wire in yourself, at a call site you choose. Aegis starts from the other end: auto_instrument() finds the frameworks already installed and instruments them in place, so one Policy covers all of them without a line of agent code changing. What it enforces is agent-shaped rather than prompt-shaped — delegation chains under a monotone trust constraint, audits of what an agent *excluded* rather than what it picked, the distance between an agent's declared intent and its measured impact, and a tamper-evident audit chain. All of it is deterministic, so there is no second model sitting in the request path. These are not exclusive choices: a semantic or model-based detector drops into GuardrailEngine.add() alongside the built-ins.
---
Primitives
The contract every adapter maps into. Framework-agnostic by design.
| Primitive | Purpose | Module |
|-----------|---------|--------|
| **Action** | Unified representation of any tool / LLM / HTTP / MCP call across all frameworks | aegis.core.action |
| **ActionClaim** | Tripartite structure — Declared (agent-authored) / Assessed (Aegis-computed) / Chain (delegation) | aegis.core.action_claim |