“Do not send that.”
A prompt or policy supplied as context can influence the model’s proposal. It is not, by itself, the permission check at the tool boundary.
Project Brake Pedal · Aegis Runtime Control
Independent runtime authorityWho is building the brakes?
Capability ≠ authority.
AI agents can change their plan. That should not change their authority. Aegis separates a model’s proposed action from the organisation’s permission to execute it, at the governed action boundary.
The field note
Prompts are not permission.
The agent can change strategy. Its authority should not change with it.
The 15-second distinction
Instruction is not execution authority.
Both matter. So do sandboxes, permissions and human approvals. Compare what each control actually does, not a caricature of it.
“This action is not authorised.”
An independent decision evaluates active authority. The enforcement point must apply the result before the system changes.
Existing platforms may enforce permissions outside the model too. The evaluation asks where Aegis adds control, duplicates it or imposes unnecessary cost.
Press the button
See the pattern. Then test the implementation.
Interactive preview
Open the existing scripted preview to explore scenarios, verdicts and sample audit records. It illustrates the pattern; it does not generate live governance evidence.
Open scripted demonstrationStay on this site
Follow a worked example without an external application. Proposed action, independent decision, enforced outcome and evidence are shown separately.
See the action boundaryIf the external preview is unavailable, the local walkthrough and evaluation summary remain accessible. For a real test, agree a controlled evaluation. Do not enter confidential, customer or production data into the preview.
Proofs, not promises
Inspect the result. Keep the limits beside it.
Prompt-policy comparator
79
Risky proposal-leakage rows.
Reported in the prompt-policy comparator path. This is a proposal endpoint, not an executed-side-effect measure.
Governed sandbox path
0 / 2,100
Risky side-effect completions.
Zero observed in the evaluated governed rows. The same path also recorded zero governed mock-tool applications.
Attempted governed decisions
1,832 / 1,832
Trusted provenance retained.
All attempted governed decisions preserved runtime-resolved provenance in this evaluation.
The result is bounded. The next test counts useful work.
6,300 total rows across 42 tasks, five run families, three conditions and ten repeats per family. Different endpoints must not be presented as a percentage reduction. These results do not establish useful allowed-task completion, universal AI safety or production bypass resistance.
Read the methods and limitations · Review the next evaluation protocol
Board-level self-check
Can your organisation answer these four questions?
If all four answers are clear, excellent. If they are not, that is probably the conversation.
Where is execution authority enforced outside the model?
What happens when the agent discovers an unexpected path?
Can you prove which active policy authorised each action?
What fails closed when authority cannot be established?
For researchers and security teams
Keep your safeguards. Test the combined system.
One workflow. Explicit allowed and prohibited actions. Useful completion, false denials, unauthorised effects, bypasses and latency all count. No predetermined winner.
Review the challenge protocolOne clear next step
Bring one consequential workflow.
Twenty minutes to identify the authority boundary and decide whether a scoped evaluation is worth doing.
One workflow. Defined scope. A decision about fit.