The evolution of artificial intelligence toward agentic systems brings new security challenges to the forefront. As AI gains the ability to modify files, send messages, and launch jobs, the safety problem shifts from harmful text generation to harmful operational side effects.
The Aegis System
Recent research published on ArXiv suggests that prompt-level governance is insufficient for creating a true execution boundary. The proposed solution is Aegis, a runtime governance system that treats model outputs as "action proposals." In this framework, the model proposes, but a trusted runtime decision layer mediates before any tool execution occurs.
Control Mechanisms and Safety
Aegis incorporates several critical features to ensure system integrity:
- Fail-Closed Execution: Under conditions of uncertainty, the system defaults to a closed state, preventing unauthorized actions.
- Senate-style Settlement: A quorum-based non-unilateral authorization path that ensures actions are vetted through a collective decision process.
- Trusted Provenance: Action provenance is resolved server-side to maintain a secure chain of custody.
Evaluation Results
In evaluations spanning a sandbox corpus of 6,300 rows across five run families, Aegis demonstrated significant efficacy. While prompt-policy conditioning alone resulted in 79 risky comparator-path leakage rows, the Aegis-governed set recorded zero governed risky side-effect completions across 2,100 rows. Furthermore, all 1,832 Aegis-attempted governed rows preserved trusted provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. The researchers emphasize that while these results do not prove general autonomous-agent safety, they support the claim that runtime action-boundary governance prevented observed risky proposals from becoming governed side effects within the evaluated environment.
