AEGIS — Governed Enterprise AI Agents

AI agents can reason and act. AEGIS ensures they can never exceed their authority.

Comment

Inspiration

AI agents are becoming increasingly capable. They can investigate incidents, use tools, delegate work, and propose actions that affect real systems. This raised a fundamental question for us:

When an AI agent becomes capable of acting, who governs its authority?

We believe intelligence should not automatically come with authority. A highly capable AI should be able to reason and propose actions without being able to grant itself permission to execute them.

That idea became AEGIS — a governed enterprise AI agent architecture where intelligence and authority are deliberately separated.

The model proposes. The control plane decides.

What it does

AEGIS handles enterprise incidents through a governed execution pipeline:

Untrusted Input → AI Reasoning → Governed Investigation → Delegation → Deterministic Policy → Human Approval → Single-Use Execution Gate → Execution → Independent Verification → Hash-Chained Audit

Gemini acts as the Commander and can reason about an incident, choose governed tools, and delegate work to specialists.

However, the model cannot:

  • Grant itself new capabilities
  • Approve its own actions
  • Bypass deterministic policy
  • Create its own execution authorization
  • Reuse an execution gate
  • Skip independent verification
  • Modify the audit history

Even when human approval is granted, approval cannot expand the authority of the action. Capability, scope, lifecycle, and risk are determined independently by the control plane.

How we built it

AEGIS was built as a Python-based governed agent system with a dedicated web dashboard that visualizes every stage of an incident.

The live AI reasoning layer uses Gemini 3.5 Flash through Vertex AI.

Our Google technology stack includes:

  • Gemini 3.5 Flash via Vertex AI
  • Google Gen AI SDK (google-genai)
  • Google Cloud Run
  • Cloud Build
  • Artifact Registry

The project is deployed as two Google Cloud Run services:

  • AEGIS Service — the governed agent and control plane
  • AEGIS Dashboard — the interface used to run and inspect incidents

The Gemini Commander provides intelligence and reasoning, while deterministic systems outside the model enforce authority. This separation was one of the most important architectural decisions in the project.

Challenges we ran into

Keeping governance independent of the model

The biggest challenge was ensuring that security was not based on simply telling the AI to behave safely.

We designed AEGIS so that critical enforcement happens outside the model. Regardless of what the model proposes, high-impact actions must pass deterministic policy, human approval when required, single-use execution authorization, and independent verification.

Handling prompt injection

Incident reports are treated as untrusted data, never instructions.

We tested adversarial incidents containing attempts to manipulate the agent, disable policy checks, self-approve actions, and trigger unauthorized behavior. The control plane remains responsible for authority regardless of what instructions appear in the incident data.

Human approval without unlimited authority

We wanted to avoid treating human approval as a blanket permission.

Approval is only one bounded part of the governance process. When approval is refused, no execution gate is issued, nothing executes, and the simulated enterprise remains unchanged.

Deploying live AI safely

Integrating Gemini through Vertex AI and deploying the architecture on Cloud Run introduced practical challenges around IAM permissions, model location configuration, service-to-service communication, and controlling live model access.

We solved these while keeping the backend governance boundaries intact.

Accomplishments that we're proud of

We are proud that AEGIS is more than an architecture diagram or a deterministic prototype.

We successfully demonstrated:

  • 4,073 passing tests
  • 302/302 governance benchmark cases passed
  • 25/25 adversarial cases contained
  • Live Gemini reasoning through Vertex AI
  • Deployment on Google Cloud Run
  • Approval-granted execution
  • Approval-refused execution with zero gates issued
  • Independent verification after execution
  • Hash-chained audit validation

Live incidents demonstrated that a real Gemini model could investigate incidents and choose its own investigation and delegation paths while still being unable to bypass the enforcement architecture.

What we learned

The biggest lesson from building AEGIS was that AI safety and AI governance are not the same thing.

A model can be highly capable and instructed to behave safely, but instructions are still interpreted by the model itself.

For higher-impact AI systems, important authority boundaries should exist independently of the model.

AEGIS explores how agents can remain autonomous and useful while their authority remains bounded, inspectable, and independently enforced.

AI agents can reason and act. AEGIS ensures they can never exceed their authority.

The enterprise environment demonstrated by AEGIS is synthetic and simulated, but the Gemini integration, governance architecture, testing, and Google Cloud deployment are real.

What's next for AEGIS — Governed Enterprise AI Agents

Our next goal is to expand AEGIS from a governed enterprise simulator toward broader real-world integrations.

Future directions include:

  • Additional governed tools and enterprise integrations
  • Live specialist models
  • More policy and risk categories
  • Expanded adversarial testing
  • Stronger observability and governance analytics
  • Additional verification mechanisms

The core principle will remain unchanged:

AI can be autonomous without being ungoverned.

Built With

Share this project:

Updates

Submission history