AegisGraph

A fresh Run resumes the same Agent workspace and Codex session with a new token and version-checked permissions.
A live Run holds a short-lived grant and exact container; the operator can revoke both through one visible control.
AegisGraph preserves an authorized update while blocking delete_service before mutation, then verifies exact-Run cleanup.
Human B sees only Native B and an independent session; resources, actions, and evidence remain owner-scoped.
Revocation removes future authority without rolling back the authorized A2 state committed before cleanup.
After one Revoke action, the Run is cancelled, authority is revoked, and policy, orchestration, and cleanup are verified.
AegisGraph keeps human credentials on the host and enforces every tool action before protected state can change.

Inspiration

AI agents can now read tickets, inspect systems, and call operational tools. However, the content they consume is not always trustworthy. A document or support ticket may contain hidden instructions that conflict with the user’s real intent.

Prompt filtering and model refusal help, but they are probabilistic. We wanted a stronger guarantee: untrusted content may influence what an agent requests, but it should never automatically inherit the user’s authority.

That idea became AegisGraph—run-scoped safety middleware for tool-using AI agents.

What it does

AegisGraph sits between an AI agent and protected actions. Every Agent Run receives a short-lived grant that defines its owner, Agent, resource, allowed actions, expected version, and expiry.

All tool requests—whether sent through our helper or directly over HTTP—must pass through the same host-side Action Broker.

AegisGraph combines three layers:

Safety: validates each action and blocks destructive operations such as delete_service and deploy_production.
Bouncer: separates Human A and Human B across Agents, Runs, messages, resources, and evidence.
GlassBox: records correlated orchestration, policy/tool, and cleanup spans for every Run.
Revoke: lets the operator cancel one exact active Run, revoke its authority, terminate its container, and verify cleanup.

The model never receives a human credential. It receives only a model credential and a temporary Run token.

How we built it

We built AegisGraph in TypeScript with a React and Vite frontend, a Fastify API, Zod validation, and a serialized JSON store.

Each Agent turn runs inside a disposable, non-root Docker container through ContainerCodexRunner. The container has a read-only root filesystem, dropped capabilities, no Docker socket, and no direct access to the host-side mock database.

The Action Broker is the only mutation path. It checks ownership, expiry, revocation, action, arguments, and resource version inside the same serialized transaction as the state change and evidence receipt. This prevents check-then-write races.

A host-side oracle reconstructs the expected state from authorized receipts and compares it with the actual protected state. Model output is never treated as proof that an action succeeded.

We also preserve an Agent’s isolated workspace, Codex home, and session across approved follow-up Runs, while issuing a new permission grant for every Run.

Challenges we ran into

The hardest problems were lifecycle and consistency problems rather than simple prompt classification.

We had to ensure that:

a legitimate write committed before revocation remains valid;
an expired or revoked Run cannot submit a late action;
cancelling an old Run never cancels a newer Run;
cleanup still happens when persistence fails;
an unreachable container engine is not mistaken for an absent container;
one owner cannot infer whether another owner’s Agent or Run exists;
credentials are redacted from storage, responses, errors, and logs;
session continuity does not accidentally reuse old Run authority.

We addressed these issues with serialized mutation queues, exact Run and container identities, fail-closed recovery, owner-scoped APIs, bounded evidence, and negative tests for forged or mismatched provenance.

Accomplishments that we're proud of

In our bounded production-chain demonstration, we exercised the real server, UI, container runner, Codex CLI, broker, persistence, and cleanup paths with a deterministic local Responses fixture.

Across four Runs sharing one Codex session:

an authorized write changed Human A’s synthetic resource from version 0 to version 1;
a later delete_service action was denied by the destructive_action policy;
the earlier authorized write remained intact;
a fresh recovery Run resumed the session and changed A from version 1 to version 2;
Human B’s resource remained unchanged at version 0;
one real UI Revoke click cancelled the exact active Run with HTTP 200 and cancelled: true;
all four disposable containers were subsequently verified absent.

We matched 16 trusted spans between the expanded UI and host records and completed four Human A → Human B → Human A isolation checks.

We also completed 12 separate real-GLM authorization-regression Runs: nine legal writes and three denied explicit illegal requests.

For one real indirect-ticket Run, the model read the ticket but made no attack call. We therefore report zero attack attempts and zero broker denials—not a successful interception. Keeping these evidence sets separate is an accomplishment we are especially proud of.

What we learned

The most important lesson is that model behavior and system authority must be treated as separate concerns.

A model may refuse a malicious instruction, follow it, misunderstand it, or fail before reaching a tool. The security boundary must remain effective in every case.

We also learned to separate:

identity from temporary execution authority;
execution status from the safety verdict;
policy denial from successful cleanup;
model-generated text from verified host state;
an attractive interface from trustworthy evidence.

Safety becomes easier to reason about when permissions are explicit, short-lived, owner-scoped, and independently observable.

What's next for AegisGraph

Our next steps are to:

validate the BytePlus ModelArk baseline;
complete three real-model indirect normal/attack/recovery repetitions;
expand policy coverage beyond the current synthetic services;
explore stronger network and data-exfiltration controls;
evaluate a production-grade identity and persistence layer;
complete the formal demonstration video and public test materials.

AegisGraph is not a universal prompt-injection detector or a production security certification. It demonstrates a practical foundation for safer agents: