Policy before effect
Use approved, active authority rather than letting the actor invent permission.
Operational AI governance
Independent runtime authorityThe agent can propose.
It cannot authorise itself.
Aegis independently verifies signed, scoped authority for governed actions. The integrated enforcement point applies the decision before a tool, API or workflow creates an effect. Allow, deny or escalate, with inspectable decision evidence.
Illustrative action decision
Allowedmapped · in bounds
31 msexample timing, not a benchmark
Verifiedsigned authority
head: 0x7f3a…a91f · bundle: sha256:4c9e…d21b · verified ✓
ClauseCOMMS-4.2 · approved customer contact
Signeracme-kms/policy-authority-01
OutcomeAction executed · receipt written
ILLUSTRATIVE UI · Fictional identifiers and sample timings, not live telemetry or a latency benchmark.
Proofs, not promises.
SOC 2 Type IIControls independently examined
ISO/IEC 27001Certified information security management
ISO/IEC 42001Certified AI management system
Scripted demonstration
Explore the control pattern in action.
Scenario verdicts and audit records in this preview are simulated. This is not a live security test and does not produce production governance evidence.
This is an interactive scripted preview, not a live production test. If it doesn't appear above, open the demo full-screen ↗. Or inspect the local action-boundary walkthrough.
The operating principle
Why was that action allowed? Show me.
The claim is not that an AI answer is correct. It is that a governed effect passed through an authority decision and an enforcement point that people can inspect.
Decision outside the model
Treat the model output as a proposal requiring independent authorisation.
Evidence at the boundary
Record the relevant control state, decision and resulting effect or block.
The problem
AI systems are becoming action engines.
The system proposing an action should not be the only system deciding whether it is allowed. Context can inform. Logs can report. Neither can independently stop the action.
Not restraint
Prompts ask nicely.
Prompt-only controls influence behaviour. Some other guardrails also enforce external permissions. Compare the actual action path and its enforcement.
Not retrieval
Context is not control.
RAG gives the model governed reading material. It still holds the pen. Aegis holds the authority to act.
Not after the fact
Logs cannot prevent.
Monitoring reports the breach. Runtime control decides before the API, workflow, or record is touched.
A field note
Better agents need explicit authority.
Prompts are not permission. A new route is not a new mandate. These are questions to test alongside existing controls, not a claim that other teams have built none.
Explore Brake PedalA scoped evaluation, not an automatic rollout
One workflow. A test that can say no.
Agree the objective, environment, required evidence, cost and delivery plan before integration. A four-week plan can be a scoping target; timing depends on access, approvals and complexity.
Scope
Name the workflow, owner, allowed actions, prohibited effects and stop conditions.
Prepare
Review policy material. Compile and sign the agreed governance bundle; independently verify it before activation.
Evaluate
Keep existing safeguards. Test legitimate completion, false denials, unauthorised effects, bypasses and recovery in an isolated environment.
Decide
Inspect the evidence and operating burden. Proceed, revise or stop before considering another workflow.
The deliverable is a scoped findings and evidence pack. It is not regulator approval, a compliance certificate or a guaranteed enterprise rollout.
Read the evaluation protocolIntegration is an engineering decision
Choose the enforcement seam you control.
These are integration patterns, not a claim that every platform has a shipped native connector. Confirm support for the exact environment during scoping.
Tool-call integration
Place a trusted enforcement point around a tool invocation. It submits the action for an Aegis decision and applies the result before calling the tool.
Action gateway
Mediate supported tool or API traffic through a controlled gateway. Routing, credentials, operation mapping and bypass handling need to be configured.
Platform action hooks
Use a platform’s available authorisation hook where it can genuinely hold execution. Validate the platform, adapter and version rather than assuming universal compatibility.
PSEUDOCODE · EXPLAINS THE PATTERN, NOT A PRODUCTION SDK CONTRACT
proposal = agent.propose(action_context)
decision = authority.evaluate(proposal, trusted_context)
# A trusted enforcement point owns the tool credentials.
enforcement.apply(decision, exact_action=proposal)
# No verified permission: no governed effect.
# On escalation: wait for a valid approval and re-evaluate.The architecture
Proposal. Decision. Enforced effect.
ILLUSTRATIVE ARCHITECTURENot live telemetry
- 01 · AGENTProposes an actionOperation, target and context
- 02 · ENFORCEMENT POINTHolds the actionSends the request to Aegis
- 03 · AEGIS / DECISIONVerifies active authorityScope · policy · provenance · approvals
- 04 · ENFORCEMENT POINTApplies the verdictAllow, deny or escalate before effect
- 05 · TOOL & EVIDENCEPermitted effect is recordedTie the effect or block to the decision
An authorisation decision is not enforcement by itself. Direct credentials and alternative routes must not bypass the integrated control.
Where the claim ends
Aegis does not automatically remove direct credentials, close an unmediated route, fix an underlying tool vulnerability or guarantee that an approved policy is appropriate. Those assumptions must be reviewed and tested with the integration.
Scoped authority
A policy stack, not one flat file.
Each layer narrows the operating envelope for the one beneath it. Internal policy can add stricter local rules; it cannot silently weaken the baseline floor.
Platform baselineRegulation, standards, industry packsFLOOR
Organisation overlayCompany policies, controls, proceduresL2
Department overlayLocal rules, approvals, exceptionsL3
Agent / workflow scopeAllowed operations, trust region, runtime HEADL4
Aegis runtime authorityActive signed composition of the full stackHEAD ✓
Before runtime
Authority has to come from somewhere.
Praxis assesses and remediates organisational policy against the assigned regulatory baseline. Aegis verifies and enforces the approved authority at runtime.
Aegis should enforce authority the organisation has actually established and approved. It should never need to invent it.
PraxisEstablish and agree authority
→AegisVerify and enforce authority
Compare the actual job
Complement. Duplicate. Fail.
All three are useful findings. A fair comparison keeps the customer’s existing controls in place.
| Control | Useful job | Question at the action boundary |
|---|---|---|
| Policy and retrieval | Make rules available for reasoning and review. | Which approved, active authority actually applies? |
| Sandbox and identity controls | Restrict reachable resources and establish identity. | Is this specific action authorised in its current context? |
| Human approval | Put designated people in the decision path. | What exact action was approved, and is that approval still valid? |
| Runtime policy enforcement | Independently authorise and mediate effects. | Does the existing implementation already meet the need? |
| Monitoring and audit | Record and detect relevant activity. | Can records tie the actual effect to the authority decision? |
What you can prove later
Every governed action leaves a verifiable chain.
The claim is not “the AI was right.” It is that the system followed a reviewed, signed, active policy state; and you can inspect the receipt for any single action.
The receipt and control-state values below are illustrative. Measured sandbox results and their limits are separate.
Policy in
Approved clause set, source-span mapped and digested.
sha256:4c9e…d21bSigned
Deterministic bundle, hashed and signed with your key.
sig:0x7f3a…a91fVerified
Runtime pointer checked live before any decision runs.
head@a91f ✓Verdict
Allow, escalate, or deny with the mapped operation.
allow · 31ms exampleReceipt
What was touched, tied back to the signed state.
rcpt:9b2c…f04eThe proof artefact
Not a dashboard claim. A receipt.
Every governed action can be traced back to the exact authority active at the moment of execution.
- Mapped operation and target
- Applicable policy clause
- Signing authority and active HEAD
- Verdict, latency, and effect
ILLUSTRATIVE RECEIPT · SAMPLE VALUES, NOT MEASURED EVIDENCE
Decision at 14:07:31.204 AEDT
Action allowed.
Operationsend_email → customer
Decision time31 ms
Policy clauseCOMMS-4.2
Scopeorg/acme/dept/sales
Signing authorityacme-kms/policy-01
Effectexecuted · receipt written
head: 0x7f3a…a91f · bundle: sha256:4c9e…d21b · receipt: sha256:9b2c…f04e
Built for the whole decision
One control plane. Four reasons to care.
Aegis gives every member of the buying committee an answer in the language of their responsibility.
For Legal
Which authority applied?
Identify the approved policy, delegation and signing authority behind the action. Inspect the applicable rule without treating a signature as proof that the policy was legally correct.
For Risk
Where can the action escape?
Map the governed operations, alternative routes and human approval requirements. Test missing authority, stale policy and recovery with the enforcement point in place.
For Audit
Can the decision be reconstructed?
Tie the policy state, operation, approval and decision to the observed effect or block. Keep example receipts separate from measured evaluation evidence.
For Technology
What will the integration require?
Confirm the supported tool-call, gateway or platform-hook pattern. Agree credential isolation, key custody, latency expectations, logging and operational ownership.
Share the one-page authority brief with your decision group.
Trust and deployment
Know what the control depends on.
Signing and custody
Agree who controls the signing authority, runtime activation and key rotation. Define the supported HSM/KMS or managed-key arrangement for the deployment.
No authority, no governed effect
The integrated enforcement path must fail closed when required authority cannot be established. Outage behaviour and recovery need testing, not just a diagram.
Data and evidence handling
Agree what action context, decision records and logs are processed, where they live and how long they are retained. Do not infer a zero-retention guarantee from the architecture.
SOC 2 Type IIISO/IEC 27001ISO/IEC 42001Request assurance scope and documentation
Earn the next deployment
Evidence first. Expansion second.
A useful result on one workflow does not establish fitness for every agent, department or tool. Re-check policy, integration, operating ownership and acceptance criteria for each expansion.
Discuss one workflowWho is accountable
Built by people who have owned enterprise control planes.
SPQR builds independent control infrastructure for agentic AI. We are a focused team out of Melbourne with backgrounds in policy compilation, distributed systems, and enterprise security engineering.
We do not sell another AI assistant. We sell the layer that decides what your assistants are allowed to do; and the evidence to prove it held.
- Enforcement over persuasion; the model asks, Aegis decides.
- Prove it or it did not happen; every decision leaves a receipt.
- Agree key custody, evidence retention and fail-closed behaviour for the deployment.
One clear next step
Put one workflow on the table.
Map the current authority boundary. Compare it with Aegis. Decide whether there is a useful test to run, with no production access required for the first conversation.
One workflow. Defined scope. A decision about fit.