Aegis — AI Agent Governance

Agent-Aegis

The governance layer for AI agents. One API, 12 frameworks, every governance primitive.

Aegis is to agent governance what Redis is to data structures — one runtime that unifies prompt-injection blocking, PII masking, policy enforcement, trust delegation, and tamper-evident audit across every agent framework. No code changes.

pip install agent-aegis → aegis.auto_instrument() → 12 frameworks are now governed.

What is Aegis • Primitives • Frameworks • Use Cases • 30-Second Start • Research • Docs • Playground

English • 한국어

---

---

What is Aegis

Every AI agent framework reinvents the same governance primitives — and each one does it slightly differently. Aegis is the abstraction layer that unifies them.

import aegis

aegis.auto_instrument() # 12 frameworks governed. No other code changes.

You don't write a LangChain guardrail and a CrewAI guardrail and an OpenAI guardrail — you write one Policy and every framework inherits it.

How this differs from the guardrail libraries

They solve a different problem, and mostly a text-shaped one. Guardrails AI validates model output against a hub of validators; NeMo Guardrails scripts conversational and tool policy in the Colang DSL; Snyk Agent Scan — Invariant Labs' mcp-scan, since the Snyk acquisition — scans MCP servers and agent skills for known risk patterns and can proxy them at runtime; LLM Guard chained input/output scanners until it was archived in July 2026. Each one you wire in yourself, at a call site you choose. Aegis starts from the other end: auto_instrument() finds the frameworks already installed and instruments them in place, so one Policy covers all of them without a line of agent code changing. What it enforces is agent-shaped rather than prompt-shaped — delegation chains under a monotone trust constraint, audits of what an agent *excluded* rather than what it picked, the distance between an agent's declared intent and its measured impact, and a tamper-evident audit chain. All of it is deterministic, so there is no second model sitting in the request path. These are not exclusive choices: a semantic or model-based detector drops into GuardrailEngine.add() alongside the built-ins.

---

Primitives

The contract every adapter maps into. Framework-agnostic by design.

Every governance feature in Aegis — anomaly detection, cost budgets, drift, cascade guards, kill switches — is a composition of these primitives. Read the Concepts guide to see how they fit together.

---

Frameworks

One API. 12 agent frameworks + 3 protocol-level adapters.

auto_instrument() detects what's installed and patches only those — no hard dependencies. Custom adapters use the same BaseAdapter interface. Every adapter above is exercised against the current upstream release daily by the integration workflow, which drives each framework's real entrypoint and asserts a guardrail fires — the unit suite fakes these frameworks, so it cannot see upstream drift on its own.

Integration policy. Native extension points win wherever one exists that can actually *block* — Google ADK's BasePlugin and CrewAI's BeforeToolCallHook both do, and there auto_instrument() patches only enough to install the native object. Pydantic AI and the OpenAI Agents SDK ship native implementations you opt into (AbstractCapability, tool_input_guardrail) alongside a patch-based path for the zero-code case. Everything else is patched because no blocking hook exists: the raw OpenAI/Anthropic SDKs and DSPy expose none, and LlamaIndex's instrumentation dispatcher emits events but swallows handler exceptions, so it can observe and not enforce.

The Pydantic AI integration is the reason this policy is written down. It was monkey-patched until core maintainer DouweM reviewed it — *"It doesn't look like those features are actually exposed as Pydantic AI capabilities?"* — and was rebuilt on the native extension API in response (src/aegis/contrib/pydantic_ai.py; the review is pydantic-ai#4888).

Patching is the fallback, not the preference — it is the part most exposed to upstream change, which is why the integration workflow exists.

Default Guardrails

Deterministic regex — no LLM calls, no network. 2.65ms cold / <1µs warm per check.

---

Use Cases

The same primitives, five different entry points. Pick whichever matches your workflow.

1. Runtime protection (most common)

One line. Any framework.

import aegis

aegis.auto_instrument()

Or zero code changes — AEGIS_INSTRUMENT=1 python my_agent.py. Injection blocking, PII masking, prompt-leak warnings, audit trail, and policy enforcement become active for every LangChain / CrewAI / OpenAI / Anthropic / LiteLLM / ADK / DSPy / LlamaIndex / Pydantic AI call.

Pydantic AI native capability — no monkey-patching, explicit per-agent control:

from pydantic_ai import Agent

from aegis.contrib.pydantic_ai import AegisCapability

agent = Agent( "openai:gpt-4o-mini", capabilities=[AegisCapability.default()], # injection, PII, toxicity, prompt-leak, hallucination ) result = await agent.run("What is AI governance?")

[Full Pydantic AI integration guide →](https://acacian.github.io/aegis/cookbook/pydantic-ai