Design targets, stated plainly.
This page describes the security architecture AEGIS is being designed to have. It is not a statement about a running service.
FLEXVOTIX holds no security certifications, and AEGIS has not been audited or penetration tested. It has not been released. Please do not treat anything here as an attestation, and do not send production data.
Principles
Six rules, each with a failure statement.
| Principle | Meaning | Failure statement |
|---|---|---|
| Deny by default | A new project can do nothing until a rule permits it. | If no rule matches, the action is denied. |
| Decisions outside the model | Models propose. The gateway decides, whatever a prompt says. | A manipulated model still cannot exceed the Mandate. |
| Credentials never reach prompts | Secrets stay in the gateway, released only after an allow decision. | A denied action never loads a credential. |
| Fail closed | Where authorization is uncertain, nothing runs. | If Guard is unreachable, the action does not run. |
| No silent repeat of side effects | Each tool declares a retry class. | An unknown payment outcome stops for a person. |
| Isolation at the data layer | Tenant keys are enforced by the database, not just application code. | A query under the wrong tenant returns no rows. |
Intended architecture
Layer by layer.
Tenant isolation
PostgreSQL row-level security with a per-request tenant setting, automated cross-tenant tests, per-tenant data keys and per-tenant storage prefixes.
Identity
People sign in through OIDC. Machines use scoped, hashed API keys. Agents have an internal identity tied to version and project, never a person's login.
Secrets
Envelope encryption with a key management service. Secrets are never returned by the API or written to logs and traces, and access is recorded.
Network
Private subnets, restricted outbound traffic and protection against requests to internal addresses and cloud metadata services.
Data
Encryption in transit and at rest. Large payloads are stored separately, with digests. Sensitive fields can be redacted before storage.
Audit
Hash-linked events for runs and for administrative actions, with periodic anchors in write-once storage.
Assurance roadmap
How we plan to earn trust.
| Activity | When | Status |
|---|---|---|
| Automated cross-tenant, fail-closed and bypass tests | Phase 1 acceptance criteria | Planned |
| Dependency and container scanning | Phase 1 | Planned |
| External penetration test, with critical findings closed | Phase 3 acceptance criterion | Planned |
| SOC 2 readiness | Phase 3, or sooner if customers require it | Planned |
| GDPR, EU AI Act and India DPDP assessment | With counsel, before production customer data | Planned |
| SSO, SCIM and private deployment | Phase 4 | Research |
Limits
What this will not do.
- It will not make a poorly written policy safe.
- It will not stop a model from being misled within its allowed scope.
- It will not make people careful approvers.
- Tamper-evident means detectable. It does not mean impossible.
Reporting
Found a problem with this website?
Since AEGIS has not been released, the only live system is this static website. Use the contact page and choose the security topic. A dedicated reporting channel will be published before release.
Reviewing agent security at your company?
We would value seeing what your review actually asks.