Aegis stops all risky AI agent actions in sandbox test

Agentic AI systems can now request tool actions that modify files, send messages, launch jobs, or change workflow state, which the authors say shifts the safety problem from harmful text generation to harmful operational side effects. Their argument is that prompt-level governance, instructions baked into the model's context, can shape behavior but cannot create a real execution boundary. To address that gap, the authors introduce Aegis, a runtime governance system that treats every model output as an action proposal rather than a command, and routes it through a trusted decision layer before any tool actually executes. In their own words, "the model proposes; the trusted runtime decides." Aegis checks each proposal against active policy state, resolves the origin of the request (provenance) on the server side rather than trusting the client, and fails closed when it cannot resolve a request with confidence, meaning uncertain proposals are blocked rather than allowed through. A subset of cases is routed to what the authors call Senate-style settlement, a quorum-based process that requires agreement from multiple parties rather than a single authority before an action is authorized. The authors tested Aegis on a repeated sandbox corpus of mock tools spanning five run families, 42 tasks, three conditions, and ten repeats per family, for 6,300 rows total. Under prompt-policy conditioning alone, without Aegis mediating execution, the corpus produced 79 rows of risky comparator-path leakage, meaning risky actions slipped through despite policy instructions in the prompt. Across the 2,100 rows governed by Aegis, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions. All 1,832 rows where Aegis attempted governance preserved trusted, Aegis-resolved provenance, and all 1,019 rows settled through the Senate process had quorum and a final signed tally as evidence. The authors are explicit about the limits of what this shows: the results do not prove general autonomous-agent safety. They frame it as a narrower systems claim, that within this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from turning into governed side effects.

Key facts

Aegis mediates every AI agent tool-action proposal through a trusted, server-side decision layer before execution, and fails closed when it cannot resolve a request with confidence.
The evaluation sandbox covered five run families, 42 tasks, three conditions, and ten repeats per family, for 6,300 rows total, all using mock tools rather than real systems.
Prompt-policy conditioning alone, without Aegis governing execution, produced 79 rows of risky comparator-path leakage.
Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions.
All 1,832 Aegis-attempted rows preserved trusted provenance, and all 1,019 Senate-settled rows had quorum and a signed final tally as evidence.

Why it matters

As agentic AI systems gain the ability to call tools that modify files, send messages, launch jobs, or change workflow state, the authors argue the safety problem stops being about what a model says and becomes about what it does. Instructions given to a model in its prompt can shape its behavior, but they do not stop a compromised or confused agent from calling a real tool. Aegis addresses this by moving the safety check out of the prompt and into a trusted runtime that sits between the model's proposal and the actual execution of any tool action.

Who it affects

The design targets anyone building or deploying agentic AI systems that grant models access to tools with real side effects, from file changes to messaging to job execution. The paper does not name specific companies, products, or deployments; the evaluation is confined to a sandbox corpus of mock tools rather than a live system.

How to use it

Aegis works by treating a model's tool call as a proposal, not a command. The trusted decision layer evaluates each proposal against the currently active policy, resolves who or what is actually making the request on the server side rather than trusting client-supplied identity, and blocks the action by default if it cannot resolve that with confidence. A subset of proposals is routed to Senate-style settlement, a quorum-based authorization step that requires multiple parties to agree rather than letting one party decide unilaterally. The paper describes this as a systems architecture rather than a commercial product, and gives no pricing or licensing terms.

How solid is it

The authors ran a repeated sandbox evaluation spanning five run families, 42 tasks, three conditions, and ten repeats per family, 6,300 rows in total. Under prompt-policy conditioning alone, the corpus produced 79 rows where risky actions leaked through a comparator path. Under Aegis governance, across 2,100 governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions. It also logged supporting evidence for its own claims: all 1,832 Aegis-attempted rows preserved trusted, Aegis-resolved provenance, and all 1,019 Senate-settled rows carried quorum and a final signed tally.

Risks and caveats

The authors state directly that these results do not prove general autonomous-agent safety. They describe the finding as a narrower systems claim: within this specific, evaluated sandbox corpus, runtime action-boundary governance prevented the risky proposals that were observed from becoming governed side effects. The evaluation used mock tools in a sandbox, not a real-world deployment, and the paper does not specify what the risky side-effect actions or comparator-path leakage concretely consisted of, nor how Senate quorum thresholds are set, nor how Aegis compares by name to any other existing governance system.

“The model proposes; the trusted runtime decides.”

— the authors