Introduction

Aegisora is an execution-control and runtime-governance system for autonomous AI agents. It sits between what an agent proposes and what actually runs in your environment.

Why an execution boundary

An agent being able to propose an action does not mean the action should execute. Aegisora evaluates each request against context, policy and risk, then resolves ALLOW, BLOCK or ESCALATE.

agent:       finance-operator
action:      external_transfer
environment: production
threshold:   elevated
decision:    ESCALATE

Illustrative policy expression.

The product, version by version

Aegisora did not start as a full runtime. Each release added a layer to the model, from a static rulebook to a closed-loop system with context, risk scoring and durable evidence.

VERSION 1.0 · FOUNDATION

The static rulebook

ARCHIVED

The first release matched every agent action against a fixed rulebook. A request either matched an allow-rule or it did not — there was no context, no scoring, no escalation path.

• Static YAML rulebooks, evaluated per action name
• Binary outcome: match or no match
• No environment or identity awareness
• Single-process deployment, no audit trail

VERSION 2.0 · CONTEXT & RISK

From rules to risk

MAINTAINED

2.0 introduced context gathering and a risk-scoring layer ahead of the policy check. The outcome stopped being binary: every request now resolves to ALLOW, BLOCK, or ESCALATE.

• Context resolution: identity, environment, workspace
• Weighted risk scoring ahead of policy evaluation
• Three-way decision: ALLOW / BLOCK / ESCALATE
• Basic decision logging (non-durable)

VERSION 3.0 · CURRENT

The full runtime

CURRENT

The current product is a closed-loop control plane. Eight stages carry every request from intent to consequence, and every decision writes durable, queryable evidence that feeds back into risk.

• Eight-stage pipeline: request through evidence
• Runtime-level enforcement, not advisory-only
• Durable, queryable evidence store
• Evidence feeds back into risk scoring (closed loop)
• Organized by workspace and role
• Approvals, incidents and webhooks as first-class objects

Capability by version

Capability	1.0	2.0	3.0
Rule-based matching	Yes	Yes	Yes
Context resolution	—	Yes	Yes
Risk scoring	—	Yes	Weighted + adaptive
Decision outcomes	Allow / Deny	Allow / Block / Escalate	Allow / Block / Escalate
Runtime enforcement	—	Advisory only	Yes, at execution boundary
Evidence store	—	Non-durable log	Durable, queryable
Feedback into risk model	—	—	Yes
Workspace / role model	—	—	Yes

Core concepts

Four ideas carry the current model. Each stage in the pipeline exists to serve one of them.

01
Policy
Declarative rules scoped by agent, action, environment and workspace.
02
Risk
A weighted score assembled from context, action sensitivity and evidence.
03
Enforcement
The decision is applied at the runtime boundary itself.
04
Evidence
Every decision and its inputs are written durably and are queryable.

Integration surface

Aegisora sits in front of tool and API calls your agents already make, without requiring a rewrite.

POST /v1/evaluate
{
  "agent": "customer-support-bot",
  "action": "stripe_refund_api",
  "environment": "production",
  "context": { "workspace": "billing", "amount_usd": 480 }
}

# Response
{
  "decision": "ESCALATE",
  "risk_score": 0.71,
  "policy_id": "pol_refund_threshold",
  "evidence_id": "ev_9f21ac"
}

Simplified evaluate/decide contract used by the current runtime.

A full SDK and API reference is not published on this site yet.

AegisoraCONTROL