Aegisora

The Zero-Trust Runtime Security & Governance Layer for Autonomous AI Agents

Live Demo  ·  Architecture  ·  Security  ·  Discord

Aegisora is an open-source, zero-trust runtime governance layer designed specifically for autonomous AI agents.

Instead of relying on traditional allow/block firewalls that can break non-deterministic agent workflows, Aegisora utilizes Asynchronous Human Escalation to pause, quarantine, and verify high-risk API calls and database queries before execution.

⚡ Quickstart: LangGraph Integration

Get Aegisora running in your stateful agent workflow in under a minute.

Aegisora acts as a drop-in middleware. Instead of letting your LangGraph nodes execute tools directly against your database, route them through the Aegisora runtime proxy to enforce zero-trust security without breaking the workflow.

1. Install

npm install @aegisora/core @langchain/langgraph

2. Wrap Your Tool Node

import { Aegisora } from "@aegisora/core";
import { StateGraph, END } from "@langchain/langgraph";

// Initialize the Zero-Trust Proxy
const aegisora = new Aegisora({
  apiKey: process.env.AEGISORA_API_KEY,
});

async function executeToolNode(state: AgentState) {
  const toolCall = state.currentToolCall;

  // 🛡️ Aegisora intercepts the action before execution (< 10ms latency)
  const governance = await aegisora.enforce({
    agentId: "finance-agent-prod",
    action: toolCall.name,
    payload: toolCall.arguments,
  });

  // Handle the 3-State Governance Decision
  switch (governance.state) {
    case "ESCALATE":
      // Automatically pauses LangGraph workflow for Asynchronous Human Review
      return {
        status: "PAUSED_FOR_HUMAN_REVIEW",
        ticketId: governance.ticketId,
      };

    case "BLOCK":
      // Kills the malicious request instantly
      return {
        status: "FAILED",
        result: "Action blocked by security policy.",
      };

    case "ALLOW":
      // Deterministic Fast-Path: Executes the actual tool
      const result = await executeRealTool(toolCall.arguments);

      return {
        status: "SUCCESS",
        result,
      };
  }
}

Note: Check out the examples/ directory for complete, runnable implementations and enterprise integration patterns.

🚀 Overview

As enterprises grant autonomous AI agents direct access to critical databases, internal tools, and production infrastructure, the attack surface for prompt injection, data exfiltration, and unauthorized action execution grows exponentially — and traditional security tooling was never designed to govern non-deterministic, self-directed software.

Aegisora sits between your AI agents and the systems they act upon as a real-time, zero-trust enforcement layer.

Every tool call, every action, and every output is intercepted, evaluated against policy, and logged — before it ever touches production.

Our core design philosophy is solving what we call the Binary Trap: the false choice between blindly allowing an agent action and blindly blocking it.

Instead of forcing a black-and-white decision on ambiguous or high-risk requests, Aegisora introduces a third state — asynchronous human escalation — so security teams get a governance layer that flexes with real-world ambiguity instead of breaking the workflow.

🎯 The Problem We Solve

Conventional security systems force a binary outcome on every request: allow or block.

For deterministic, low-risk traffic this works.

For autonomous AI agents making judgment calls in ambiguous, high-stakes situations, it doesn't — organizations are left choosing between over-blocking (killing agent productivity) or over-permitting (accepting unacceptable risk).

Aegisora resolves this with a three-state decision model:

🛡️ Core Capabilities

• Zero-Trust Action Proxy — Every agent action and tool call is intercepted and validated in real time before execution; nothing reaches production systems unchecked.

• The Human Review Queue — High-risk or ambiguous actions are escalated asynchronously for human approval instead of being blindly blocked, preserving agent throughput while keeping a human in the loop for consequential decisions.

• Prompt Injection Firewall — Detects and neutralizes adversarial inputs designed to override system instructions or hijack agent behavior.

• PII Data Masking — Automatically detects and redacts sensitive data such as credit card numbers, national IDs/SSNs, email addresses, and other regulated data classes from agent inputs and outputs before it can leak.

• Live Telemetry & Reasoning Trace — Full observability into agent workflows, decision paths, and policy outcomes (approved / flagged / blocked) as they happen, with a complete audit trail for compliance.

• Execution Integrity Proofs — Cryptographic provenance for workload execution, enabling verifiable, tamper-evident audit records.

For a full breakdown of the request lifecycle and system internals, see ARCHITECTURE.md.

For our threat model and disclosure policy, see SECURITY.md.

🏗️ Tech Stack

📦 Getting Started Locally

Prerequisites

• Node.js 18+
• npm or yarn
• Git

1. Clone the Repository

git clone https://github.com/aegisora-ai/aegisora.ai.git
cd aegisora.ai

2. Install Dependencies

npm install

Or:

yarn install

3. Configure Environment Variables

Copy the example environment file:

cp .env.example .env.local

Populate .env.local with your API keys and Supabase credentials.

Important: Never commit .env.local, API keys, access tokens, or other secrets to the repository.

4. Run the Development Server

npm run dev

Or:

yarn dev

Open http://localhost:3000 to view the application.

🤝 Contributing

Aegisora is built in the open, and contributions of any size are welcome — from fixing a typo to designing a new detection rule for the policy engine.

Contribution Workflow

1. Fork the repository.
2. Create a feature branch:

git checkout -b feature/your-feature

1. Make your changes.
2. Add or update tests where appropriate.
3. Commit your changes.
4. Push your branch.
5. Open a Pull Request.

Check the Issues tab for tasks labeled good first issue.

Join the Discord community to connect with contributors and discuss the project.

See CONTRIBUTING.md for the full workflow and coding standards.

📄 License

This project is open-source under the MIT License.

✨ Contributors

Thanks to all the people who contribute to Aegisora.

This project follows the all-contributors specification.

Contributions of any kind are welcome — code, documentation, testing, security research, integrations, ideas, and more.