Aegis Fleet

• 

  prompt injection

• 

  overspend action

Inspiration

Enterprise AI agents are increasingly trusted to make payments, access data, and operate systems. The risk is not only a bad model response: an agent can be delegated too much authority, call the wrong tool, or be redirected by untrusted prompt content.

We built Aegis to make autonomous agent actions governable. Instead of trusting each agent to protect itself, Aegis puts a zero-trust security gateway in front of every privileged action.

## What it does

Aegis Fleet registers each agent’s identity, owner, trust tier, permitted tools, capabilities, and policy assignments.

Every action then passes through two layers:

1. Deterministic policy enforcement — hard rules such as spending limits, approved vendors, tool allowlists, capability allowlists, and quarantine status.
2. Gemini contextual risk analysis — an advisory investigator that looks for anomalous behavior and prompt-injection signals.

Hard policy always wins. Gemini never executes tools and cannot override an explicit denial.

When Aegis detects a dangerous action, it blocks execution, creates an incident, publishes a security event, records durable evidence, and can automatically quarantine the agent.

## Demo scenarios

The live dashboard demonstrates three paths:

• A safe payment to an approved vendor is allowed.
• A $40,000 payment to an unapproved vendor is denied and creates a high-severity incident.
• A compromised support agent receives a prompt- injection attempt to export payroll data. Aegis raises its behavioral risk, creates a critical incident, and quarantines the agent.

The dashboard also verifies a SHA-256 hash chain across audit events, making it easy to demonstrate that the evidence has not been altered.

## How we built it

We built Aegis as a TypeScript monorepo with a React/ Vite dashboard and a Hono API gateway.

Google ADK and Gemini on Vertex AI provide schema- validated risk assessments. Firestore stores agents, actions, incidents, and audit records. Pub/Sub publishes typed security events. The app is packaged with Docker and deployed on Cloud Run using a dedicated least-privilege service account.

We added automated tests for policy enforcement, incident creation, quarantine behavior, audit-chain verification, and graceful fail-closed behavior when the advisory model is unavailable.

## Challenges we ran into

The main challenge was making AI assistance useful without making it the security boundary. We designed the gateway so deterministic policy is authoritative, while Gemini is advisory and cannot gain direct execution capability.

We also worked through production deployment details: pnpm’s reviewed build-script policy, Cloud Run’s dedicated runtime identity, Docker workspace dependencies, and Vertex AI environment configuration. These constraints improved the final design: the deployed service now fails closed if the model is temporarily unavailable rather than turning a security denial into an error.

## Accomplishments we're proud of

• A public, interactive Cloud Run demo.
• A real Gemini + Vertex AI integration with deterministic guardrails.
• Automatic agent quarantine after repeated prompt- injection signals.
• Firestore persistence, Pub/Sub security events, and tamper-evident audit verification.
• A clear live story: allow, deny, contain, and prove.

## What's next

The next step is to hydrate dashboard state from Firestore across Cloud Run restarts, add authentication and role-based access control, connect the gateway to real enterprise tool adapters, and introduce alert routing and approval workflows.

Built With

• cloud-run
• docker
• firestore
• gemini
• google-adk
• google-cloud
• hono
• node.js
• pnpm
• pub/sub
• react
• typescript
• vertex-ai
• vite
• vitest
• zod