Introduction

Aegisora is an execution-control and runtime-governance system for autonomous AI agents. It sits between what an agent proposes and what actually runs in your environment.

Why an execution boundary

An agent being able to propose an action does not mean the action should execute. Aegisora evaluates each request against context, policy and risk, then resolves ALLOW, BLOCK or ESCALATE.

agent:       finance-operator
action:      external_transfer
environment: production
threshold:   elevated
decision:    ESCALATE

Illustrative policy expression.

The product, version by version

Aegisora did not start as a full runtime. Each release added a layer to the model, from a static rulebook to a closed-loop system with context, risk scoring and durable evidence.

VERSION 1.0 · FOUNDATION

The static rulebook

ARCHIVED

The first release matched every agent action against a fixed rulebook. A request either matched an allow-rule or it did not — there was no context, no scoring, no escalation path.

• Static YAML rulebooks, evaluated per action name
• Binary outcome: match or no match
• No environment or identity awareness
• Single-process deployment, no audit trail

VERSION 2.0 · CONTEXT & RISK

From rules to risk

MAINTAINED

2.0 introduced context gathering and a risk-scoring layer ahead of the policy check. The outcome stopped being binary: every request now resolves to ALLOW, BLOCK, or ESCALATE.

• Context resolution: identity, environment, workspace
• Caller-supplied risk value evaluated against policy conditions
• Three-way decision: ALLOW / BLOCK / ESCALATE
• Basic decision logging (non-durable)

VERSION 3.0 · CURRENT

The full runtime

CURRENT

The current product is a closed-loop control plane. Eight stages carry every request from intent to consequence, and every decision writes durable, queryable evidence that feeds back into risk.

• Eight-stage pipeline: request through evidence
• Decision API called before your agent executes an action
• Durable, queryable evidence store
• Hash-chained evidence record for every decision
• Organized by workspace and role
• Approvals, incidents and webhooks as first-class objects

Capability by version

Capability	1.0	2.0	3.0
Rule-based matching	Yes	Yes	Yes
Context resolution	—	Yes	Yes
Risk input	—	Yes	Caller-supplied score (0-100), usable in policy conditions
Decision outcomes	Allow / Deny	Allow / Block / Escalate	Allow / Block / Escalate
Decision point	—	Advisory only	Decision API at the execution boundary
Evidence store	—	Non-durable log	Durable, queryable
Evidence hash per decision	—	—	Yes
Workspace / role model	—	—	Yes

Core concepts

Four ideas carry the current model. Each stage in the pipeline exists to serve one of them.

Policy

Declarative rules scoped by agent, action, environment and workspace.

Risk

A 0-100 value sent with the request, usable in policy conditions.

Decision

Aegisora returns ALLOW, BLOCK or ESCALATE. Your code continues only on ALLOW.

Evidence

Every decision and its inputs are written durably and are queryable.

Integration surface

Aegisora sits in front of tool and API calls your agents already make, without requiring a rewrite.

curl -X POST https://aegisora.org/api/v1/evaluate \
  -H "Authorization: Bearer aeg_live_<your-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "agent": "customer-support-bot",
    "action": "stripe_refund_api",
    "resource": "invoice/INV-1042",
    "risk": 40,
    "input": { "amount_usd": 480 }
  }'

# 200 response
{
  "decision_id": "<uuid>",
  "effect": "ESCALATE",
  "reason": "<text>",
  "policy_id": "<uuid or null>",
  "approval_id": "<uuid or null>",
  "execution_id": null,
  "trace_id": "<id>",
  "evidence_hash": "<hash>",
  "agent_registered": false
}

Request and response shape of the current endpoint. The outcome depends on your policies. Errors return { error: { code, message } }.

A full SDK and API reference is not published on this site yet.