Aegis Control Plane

Three steps

Register the agent in this console, issue it an enrollment key, then wrap your tool functions. Everything else — which credentials it may use, which connectors it may call, which guardrails apply — is configured here and picked up by the SDK at runtime.

1. Install

pip install aegis-sdk

2. Point it at your agent's identity

Go to Agents → your agent → the Enrollment keys tab → Mint key. The key is displayed once, at creation, and cannot be retrieved afterwards — if you lose it, revoke it and mint another. Then put it in the environment wherever the agent runs. No VPN and no inbound ports are required; the SDK makes outbound calls only.

export AEGIS_API_BASE=https://aegis.example.com/api/aegis
export AEGIS_AGENT_KEY=agk_a1b2c3d4_...   # from the Enrollment keys tab

# Declares whether this agent's egress is restricted by the network.
# There is no default: 'governed' on a machine with open egress refuses
# to start, and 'development' is recorded as UNATTESTED.
export AEGIS_ENFORCEMENT=development       # or 'governed' — see below

The governed client-zone bundle also supplies its durable local-audit connection and control-plane service token. Use that bundle for a pilot instead of copying those deployment-only values into an agent project.

pip install alone does not make an agent governed

On a laptop, a bare VPS or any normal network, the agent can reach a model provider directly — import openai bypasses the SDK entirely, and no decorator can prevent that. Aegis still registers, audits and policy-checks this agent, but it does not contain it, and the console shows it as UNATTESTED.

A governed deployment runs the agent inside a network whose egress is restricted, so the only route out is through the gateway. The SDK verifies this at startup and refuses to run if it is false. Use the client-zone bundle in deploy/client-zone/ for a pilot; development mode is for building and testing.

3. Wrap the agent

from uuid import uuid4

from aegis_sdk import guard
from aegis_sdk.guard import aegis_session
from aegis_sdk.live import PostgresAuditSink
from aegis_sdk.platform import context_from_env

ctx = context_from_env(session_id=str(uuid4()), audit=PostgresAuditSink())

@guard(tool_name="query_trials", connector="hospital-ctms", scope="read")
def query_trials(condition: str, *, aegis_ctx=None, aegis_cred=None) -> list[dict]:
    """Every call through this decorator is checked and audited.

    If "hospital-ctms" is not bound to this agent, or the agent is not
    granted the "read" scope on it, the call is BLOCKED and logged — not
    silently dropped and not allowed through with a warning.
    """
    return ctms_client.search(condition=condition, token=aegis_cred.secret)

with aegis_session(ctx):
    result = query_trials("type 2 diabetes")

An undecorated function bypasses the guard

This is inherent to the decorator pattern: nothing can force a function to carry it. The compensating controls are registration in this console and human review at wrap time. Run aegis-sdk check . in CI to find tool functions that reach a connector without going through the guard.