AEGIS-X — Let Agents Think. Control How They Act.

Inspiration

AI is rapidly moving beyond simple chatbots. Modern AI agents can plan tasks, use tools, access databases, call APIs, interact with cloud services, delegate work to other agents, and execute multi-step workflows.

As these agents gain more autonomy, a critical problem emerges: How do we make sure an AI agent performs only the actions necessary for its assigned goal?

Traditional access-control systems mainly determine whether a user or application has permission to access a resource. Autonomous agents introduce a new challenge because their plans can evolve while they are working. An agent may have valid access to a system but attempt an action that is unnecessary or inconsistent with its original task.

This inspired us to develop AEGIS-X — Autonomous Execution, Governance & Investigation System, a zero-trust governance layer designed to make autonomous AI agents more controlled, observable, and accountable.

Our vision is simple:

Allow AI agents to act autonomously, but never beyond their authorized purpose.

What it does

AEGIS-X operates as a secure control layer between AI agents and enterprise resources such as databases, APIs, cloud services, software tools, and IoT devices.

When an agent receives a goal, AEGIS-X analyzes the goal and proposed workflow before allowing access to enterprise tools.

The platform follows a controlled execution cycle:

Goal → Plan → Permission → Execute → Monitor → Verify → Learn

For example, if an agent receives the task:

“Investigate why the payment service became slow after today's deployment.”

the agent may plan to inspect system metrics, application logs, deployment history, source-code changes, and database performance.

AEGIS-X then determines the minimum permissions required for that specific task and creates temporary task-scoped authorization.

During execution, AEGIS-X continuously monitors tool requests. If the agent unexpectedly attempts to access unrelated customer information or perform an unauthorized operation, the system detects plan drift and blocks or escalates the action.

High-risk operations can require human approval before execution.

After an approved action is completed, AEGIS-X verifies whether the intended outcome was actually achieved. Successful and failed workflows can then become part of a searchable organizational incident memory for future investigations.

Critical authorization and execution events can additionally be protected through tamper-evident audit records.

How we built it

AEGIS-X is designed as a modular agentic architecture rather than a single AI model.

The major components include:

Planner Agent — converts a high-level objective into a multi-step execution plan.
Intent-to-Permission Engine — identifies which resources and operations are actually required by the plan.
Policy Enforcement Layer — allows or denies tool requests based on task-specific authorization.
Plan Drift Guardian — compares actual agent actions against the approved goal and workflow.
Delegation Controller — restricts permissions when one agent delegates work to another agent.
Human Approval Layer — pauses high-risk operations until an authorized person approves them.
Execution Monitor — records observable agent and tool activity.
Outcome Verifier — checks whether an executed action actually achieved the requested objective.
Organizational Memory — stores verified incidents, solutions, failed approaches, and outcomes for future retrieval.
Audit Layer — creates tamper-evident records for critical agent actions.

The proposed technology stack includes Python, FastAPI, LangGraph, MCP-compatible tools, PostgreSQL, pgvector, Open Policy Agent, OpenTelemetry, React, Docker, MQTT, and ESP32 for optional IoT/embedded integration.

Instead of giving an autonomous agent unrestricted access to every connected system, AEGIS-X places a security and governance checkpoint between the agent and every important tool.

Challenges we ran into

One of the biggest challenges was determining how to distinguish between an action that is technically permitted and an action that is actually necessary for the agent's current objective.

Another challenge was designing dynamic permissions. Autonomous agents may modify their plans as new information appears, so a completely static permission model can either become too restrictive or grant excessive access.

We also had to consider how to monitor agents without depending on hidden model reasoning. Our approach focuses on observable information such as the agent's declared goal, generated task plan, requested tools, permissions, external actions, results, approvals, and final outcomes.

Another important challenge was balancing autonomy and human control. Low-risk read operations should not require constant manual approval, while sensitive or high-impact actions must remain under appropriate human supervision.

Accomplishments that we're proud of

We designed AEGIS-X around the idea that AI autonomy should increase together with accountability.

Key innovations in our proposed system include:

Converting agent intent into temporary least-privilege permissions
Detecting plan drift during autonomous execution
Controlling permissions across multi-agent delegation
Introducing risk-based human approval
Recording an observable Agent Black Box execution history
Verifying outcomes instead of assuming an executed action was successful
Automatically revoking permissions when a task ends
Building reusable organizational memory from verified incidents
Creating tamper-evident audit evidence for critical actions
Extending the same governance model to IoT and embedded devices

Together, these capabilities transform AEGIS-X from a simple monitoring dashboard into a control plane for autonomous AI agents.

What we learned

While developing AEGIS-X, we learned that building powerful autonomous agents is only one part of the challenge.

The more important question is:

How can organizations safely trust those agents to take real actions?

We learned that agent security requires more than traditional authentication. Systems need to understand intent, task context, tool usage, delegation, risk, execution behavior, and outcomes.

We also learned that human oversight should not disappear when automation increases. Instead, humans should focus on the decisions where their judgment