A policy check in front of every tool you wrap
For AI and platform engineers. A Python SDK: one client, a decorator on each tool. Policy changes reach your agents without a redeploy.
Install, create a client, wrap a tool
- Install.
pip install aegislib - Create a client. Turn on auto-instrumentation if you want traces of model and framework calls.
- Wrap each tool with the decorator. The
tool_namemust match the tool's id in your policy; an unknown tool is denied. - Works with LangChain, LangGraph, LlamaIndex, CrewAI and MCP, and with OpenAI, Anthropic, Amazon Bedrock, Gemini and Vertex AI, Azure OpenAI and other providers.
from aegis import Aegis, aegis_guard
client = Aegis(api_key="…", auto_instrument=True)
@aegis_guard(client, agent_id="refund-agent",
tool_name="crm.issue_refund")
def issue_refund(customer_id, amount, currency): ...
# a blocked call raises ForbiddenErrorAuto-instrumentation records traces. Policy is checked on the tools you wrap.
Four decisions, decided before the tool runs
When several rules apply, block wins, then hold, then mask, and allow only if nothing objected.
| Decision | Name in the SDK | What happens in your code |
|---|---|---|
| allow | allow | The tool runs as written. |
| mask | sanitize | The tool runs with the flagged fields rewritten. |
| hold | approval_needed | The call waits while approvers see the parameters. Approved calls run; one rejection denies. |
| block | deny | The tool does not run. The SDK raises ForbiddenError. |
| No decision | fails closed | Unknown tool, evaluation error or unreachable decision service: treated as block. Per-tool open mode exists and every call made under it is recorded as a gap. |
Approvers decide in the Aegis console today. Delivery to Slack, Teams and email is next. A kill switch stops one agent's tool calls, or all of them.
Small overhead, predictable failure
The policy check adds little time inside your process. The round trip to the decision service depends on where it runs, so we measure it with you.
Measured on 24 September 2026 on the SDK path with the network mocked.
- Decision service: in Aegis SaaS (Google Cloud, US regions) or in the appliance inside your network.
- If it is unreachable: the call is blocked, never silently allowed.
Policy is versioned data, not code
- Plain YAML. Author, validate, compile and promote. Versions are immutable and history is kept.
- No redeploy. Promotion is one switch, and agents pick up the new version on their next call.
- Limits per tool. Value ranges, allowed values, calls per second, spend caps and approval thresholds.
- Test before you enforce. Replay a change against past calls to see what would be blocked or held, or run it in shadow mode first.
- A first draft for you. Aegis drafts controls from the calls your agents actually made, for you to review.
tools:
- id: crm.issue_refund
params:
- field_name: amount
conditions: [{type: range, range: {min: 1, max: 25000}}]
limits: {qps: 2, approval_threshold_usd: 5000}
approval_config: {approve_count: 2}Refunds from $1 to $25,000, at most two calls a second; over $5,000 needs two approvers.
What leaves your process
You decide how much is recorded. Sensitive values are handled inside your process first.
| Capture mode | What reaches Aegis |
|---|---|
| None | Decisions only, for enforcement and evidence |
| Metadata | Tool, decision, timing and field names, without values |
| Full | Parameters too, after personal data and secrets are redacted in your process |
| Data rules | For masked or blocked data: the data class, field and count, never the value |
| OpenTelemetry | Export to your own collector, off until you turn it on |
Try it on one agent.
We will wrap one of your tools with you, write the first policy, and measure the round trip in your environment.