Aegisora runtime reference

Securing the model is not enough once agents can call tools, providers and external systems. Aegisora secures what the agent is allowed to do: every action is evaluated, decided and enforced at the execution boundary, and every outcome is recorded as evidence.

Where Aegisora sits

Enforcement state and execution outcome

Aegisora separates what governance decided from what actually happened. This lets you answer both questions for any action.

Canonical correlation identifiers

ToolRegistry is the single canonical authority for governed tool execution. Overlapping legacy authority surfaces were removed so that execution can never be governed by competing implementations.

GOVERNANCE
  |
  v
ToolRegistry
  |
  v
Authorization Capability
  |
  v
AgentExecutor
  |
  v
RuntimeTool
  |
  v
EXECUTION

Capability-based execution

• Authorization must exist and be valid.
• Authorization must match the scope of the requested action.
• Authorization is single use, which provides replay resistance at the execution boundary.

Provider governance ordering

REQUEST -> GOVERNANCE -> PROVIDER RESOLUTION -> MODEL RESOLUTION -> PROVIDER INVOCATION

Governance runs before provider and model resolution. BLOCK and ESCALATE therefore prevent resolution entirely. Provider identity and model identity are immutable after governance, and provider and model must be consistent.

What a seal binds

Authority integrity

• Authority-state fingerprinting
• Authority mutation detection
• Authority drift detection
• Transitive authority reconciliation
• Workspace-scoped authority verification
• Fail-closed execution when authority changes

Enforcement at the boundary

VALID STATE            CHANGED STATE
    |                      |
    v                      v
  ALLOW                  BLOCK
    |                      |
    v                      v
EXECUTION          NO EXTERNAL SIDE EFFECT

A continuity violation is enforced before the external side effect occurs. Modified action payloads, resources, tools or execution inputs are rejected when they no longer match the sealed execution state.

Provider and tool execution

Effect reconciliation

After execution, the runtime reconciles the observed effect against the sealed execution identity: authorized intent, sealed execution, actual effect. The reconciliation result is part of the evidence record.

• Canonical evidence creation at the enforcement boundary
• Persistent evidence storage
• Deterministic trace, decision, execution and evidence correlation
• Synchronized evidence finalization
• Retention for blocked and prevented actions
• Retrieval by trace, decision and agent
• Execution-level linkage through sealId and continuity enforcement status (v4.0)

The enterprise layer adds an immutable evidence ledger and an enterprise audit ledger, with trace, decision, execution and evidence correlation preserved end to end.

PENDING -> APPROVED
        -> REJECTED
        -> EXPIRED

• Approvals are workspace-isolated.
• Approval state is enforced at runtime, not only recorded.
• Resolution is synchronized back to the governed execution.

• Tool security evaluation before authorization
• ToolRegistry enforcement as the single canonical authority
• External tool governance
• MCP tool governance
• Authorization receipts bound to the Continuity Seal (v4.0)
• Post-execution effect reconciliation (v4.0)

Agent -> Request -> Governance Runtime -> Decision -> Execution

Configuration

Configuration covers runtime behavior, policies, providers, logging and environment variables. Never commit API keys or other credentials; use local environment configuration for development secrets.

v4.0.0 validation, as published in the release notes

Supply-chain discipline

• Security Readiness enforced in CI
• Package metadata, npm tarball content and package scope validation
• Release artifacts regenerated from the final release tree, with SHA256 evidence (v2.0.0)
• Release gate metadata rebound to the final commit

Each release is tagged in the core repository. Compare views and full notes are available on the GitHub releases page.