Every release, from foundation to enterprise runtime.

Runtime Enforcement

• ALLOW / BLOCK / ESCALATE execution decisions
• Enforcement at the execution boundary
• BLOCK prevents provider and tool execution
• ESCALATE stops execution pending approval

Enterprise Identity and Access

• Workspace isolation
• RBAC
• Server-side authorization
• Tenant boundary enforcement

Agent and Provider Governance

• Agent registry and discovery
• Provider and model registry
• Governed model resolution
• Provider and model identity integrity

Policy and Risk

• Policy Studio
• Policy versioning
• Risk detection
• Deterministic governance decision precedence

Approval Engine

• Enterprise approval lifecycle
• PENDING to APPROVED / REJECTED / EXPIRED
• Workspace isolation
• Runtime approval enforcement
• Resolution synchronization

Evidence and Audit

• Tamper-evident evidence ledger
• Runtime evidence persistence
• Enterprise audit ledger
• Trace, decision, execution and evidence correlation

Tool Security

• Tool security evaluation
• ToolRegistry enforcement
• External tool governance
• MCP tool governance

Realtime Operations

• Enterprise realtime events
• Runtime-to-enterprise event bridge
• Persistent realtime writers
• Event subscriptions

Incidents, Alerts and Webhooks

• Enterprise incident ledger
• Governance orchestration
• Alert rules
• Webhook governance

Usage and Entitlements

• Enterprise usage ledger
• Usage metering
• Persistent usage projection
• Execution entitlements
• Provider-level entitlement enforcement
• Execution quota enforcement

Enterprise Contracts

• Billing state contracts
• SSO identity contracts (interface definitions; not verified with a customer IdP)
• SCIM provisioning contracts (interface definitions; not verified with a customer IdP)
• Enterprise recovery contracts

Security Model

Aegisora enforces governance before execution. A blocked or escalated action does not reach the provider. The runtime is designed around zero-trust execution, tenant isolation, auditable decisions and evidence-backed enforcement.

Explicit Security Boundary

The decision boundary stays explicit: ALLOW, BLOCK, ESCALATE.

Platform Surface

• @aegisora/audit
• @aegisora/core
• @aegisora/observability
• @aegisora/plugins
• @aegisora/policy-engine
• @aegisora/runtime
• @aegisora/sdk
• @aegisora/security-engine
• @aegisora/storage
• All nine packages aligned at 2.0.0

Runtime Security

• Canonical provider identity and canonical model identity
• Provider/model consistency
• Protected agent execution boundaries
• Forged identity rejection
• Governance-before-resolution ordering
• Fail-closed BLOCK and ESCALATE behavior
• Canonical correlation integrity

Evidence and Observability

• Runtime-generated security identity preserved through governance and execution
• Release artifacts regenerated from the final release tree
• SHA256 evidence shipped with every artifact

Correlation Identity Integrity

The runtime rejects attacker-controlled correlation identifiers as canonical identity. Runtime-generated identifiers remain authoritative across governance, enforcement, execution, evidence and audit.

• traceId
• decisionId
• executionId
• evidenceId
• correlationId

Security Property

Request identity must remain canonical throughout the security record. Metadata may describe a request, but it cannot redefine the runtime's authoritative identity.

Canonical Correlation

Each governance decision remains independently identifiable.

• traceId
• decisionId
• executionId
• evidenceId

Fail-Closed Behavior

• Forged runtime identities are rejected
• BLOCK prevents execution and preserves the prevented / not-attempted state
• ALLOW carries canonical correlation into governed execution
• Audit and evidence stay tied to runtime-generated identity, not attacker-controlled metadata

Security Coverage

• Governance-gated model resolution
• Provider and model identity immutability
• Post-governance model integrity
• Provider/model consistency
• Cross-provider resolution authority
• Protected agent execution boundaries
• Governance-boundary contract validation

Single Canonical Authority

ToolRegistry became the single canonical authority for governed tool execution.

Legacy Authority Elimination

Overlapping legacy runtime authority surfaces were removed so execution could no longer be governed by competing implementations. The objective was not simply deletion, but removing ambiguity from the security authority graph.

Capability-Based Execution

• Execution requires valid, scoped authorization
• The runtime validates authorization existence, validity, scope and single-use consumption
• Single-use authorization gives replay resistance at the execution boundary

Provider Governance Ordering

BLOCK and ESCALATE prevent downstream provider and model resolution.

Evidence as a First-Class Security Object

• Canonical evidence creation at the enforcement boundary
• Persistent evidence storage
• Deterministic trace, decision, execution and evidence correlation
• Synchronized evidence finalization
• Evidence retention for blocked and prevented actions
• Evidence retrieval by trace, decision and agent

Enforcement Semantics

The release formalized the difference between enforcement state and execution outcome, so you can answer both: what did governance decide, and what actually happened at the execution boundary?

• Enforcement: not_executed, executed, prevented, escalated
• Execution: not_attempted, succeeded, failed

Security and Release Hardening

• Stronger controls around measurable security evidence
• Security Readiness CI enforcement
• Package metadata validation
• npm tarball and package-scope validation
• Build, typecheck, runtime and example verification
• Automated release validation and reproducible release controls

Supply-Chain Discipline

Release-time checks run against actual package artifacts rather than relying only on source-tree inspection. This became the basis for the evidence-driven release process of later versions.

Stability Before Expansion

Focused on runtime refinement, package organization, repository maintenance, documentation improvements, developer onboarding and infrastructure stabilization. The goal was deliberately conservative: strengthen the foundation before increasing the security contract's complexity.

Developer Experience

Continued the move from an initial runtime prototype toward a structured package ecosystem and a more predictable developer workflow.

Engineering Direction

The architecture stayed centered on governed execution while the surrounding project structure matured.

The First Runtime Boundary

Agent actions are evaluated before reaching external tools and providers, with explicit ALLOW, BLOCK and ESCALATE outcomes.

Developer Foundations

• Runtime request interception
• Policy evaluation
• Security analysis
• Execution enforcement
• Runtime observability
• Audit-oriented execution tracking
• LangChain / LangGraph integration

Why It Matters

The architectural starting point of Aegisora's later security and governance model: governance at the execution boundary, not after an agent has already acted.