Skip to main content

๐Ÿ›ก๏ธ AEGIS Core

Execution-Boundary Authorization & Atomic L3 Settlement for AI Agents

Enforce before execution. Verify before settlement.

AEGIS is a security and economic-control layer for high-risk AI-agent tool calls โ€” combining atomic budget enforcement, replay-safe authorization, deterministic receipts, SHA-256 action references, Ed25519 signatures, and an isolated atomic L3 settlement layer.

Python Version License Status Security L3

pip install aegis-core-lortuarte-sdk

๐Ÿšจ The Problem

Autonomous AI agents can initiate payments, purchases, trades, API actions, and other irreversible tool calls concurrently.

A policy decision made too far away from execution can leave room for:

                 AI AGENT
                    โ”‚
                    โ–ผ
                TOOL INTENT
                    โ”‚
           โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
           โ”‚        โ”‚        โ”‚
           โ–ผ        โ–ผ        โ–ผ
        CALL #1  CALL #2  CALL #N
           โ”‚        โ”‚        โ”‚
           โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                    โ”‚
                    โ–ผ
          CONCURRENT STATE RACE
                    โ”‚
          โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
          โ”‚                   โ”‚
          โ–ผ                   โ–ผ
   DUPLICATE EXECUTION     OVERSPEND

AEGIS moves the authorization boundary directly in front of tool execution.

                  AI AGENT
                     โ”‚
                     โ–ผ
                 TOOL INTENT
                     โ”‚
                     โ–ผ
           โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
           โ”‚      ๐Ÿ›ก๏ธ AEGIS       โ”‚
           โ”‚  AUTHORIZATION GATE โ”‚
           โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                      โ”‚
                โ”Œโ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”
                โ”‚           โ”‚
                โ–ผ           โ–ผ
              ALLOW       DENY
                โ”‚           โ”‚
                โ–ผ           โ–ผ
          EXECUTE TOOL    ๐Ÿ›‘ BLOCK

The protected tool executes only after an explicit ALLOW decision.


โšก What AEGIS Does

AEGIS Core 3.3.0 focuses on the economic and authorization boundary between an autonomous agent and a high-risk external action.

๐Ÿ”’ Atomic Budget Enforcement

Concurrent mutations of the process-local ledger are serialized by a lock.

๐Ÿ” Replay-Safe Idempotency

An exact replay of the same authorization returns the historical receipt without consuming the budget again.

Reuse of the same transaction identity with conflicting economic data is denied.

๐Ÿ”— Tool-Call Cryptographic Binding

tool_call_id participates in the authorization identity used to derive the signed action reference.

Changing the tool-call identity changes the resulting action_ref.

๐Ÿ”‘ Signed Authorization Receipts

AEGIS produces deterministic authorization payloads protected by:

Deterministic Payload
        โ”‚
        โ–ผ
      SHA-256
        โ”‚
        โ–ผ
      Ed25519
        โ”‚
        โ–ผ
Signed Authorization Receipt

๐Ÿงช Tamper Detection

Changing signed authorization data invalidates cryptographic verification.

๐Ÿ›‘ Fail-Closed Behavior

Internal authorization failures deny execution.

An explicitly configured invalid Ed25519 private key aborts startup rather than silently replacing the configured cryptographic identity.

๐Ÿ’ฐ Decimal Monetary Accounting

Economic state uses Python Decimal rather than binary floating-point arithmetic.

AEGIS Core 3.3.0 supports monetary amounts with up to 6 decimal places.

  • Minimum supported positive amount: $0.000001
  • $0.001 micropayments are supported
  • Amounts with more than 6 decimal places fail closed
  • L3 settlement stores value as integer monetary units at a scale of 1,000,000 units per USD

๐Ÿฆ Atomic L3 Settlement

An isolated settlement layer consumes signed AEGIS authorizations and performs atomic buyer โ†’ seller balance transitions using SQLite transactions.


๐Ÿ“ฆ Installation

pip install aegis-core-lortuarte-sdk

Requirements:

Python >= 3.8
cryptography

cryptography is installed automatically by the package.


๐Ÿš€ Quickstart

from decimal import Decimal
from aegis import AegisLocalPolicyGate

gate = AegisLocalPolicyGate()

agent_id = "agent-demo-001"

gate.ledger_data[agent_id] = Decimal("10.00")

receipt = gate.evaluar_gasto(
    agent_did=agent_id,
    operation="stripe_charge",
    tool_call_id="payment-001",
    amount_usd="3.00",
)

if receipt["policy_decision"] == "allow":
    print("AUTHORIZED")
    # Execute the protected tool here.
else:
    print("BLOCKED")

print(receipt)

Expected authorization:

AUTHORIZED

Economic transition:

$10.00
   โ”‚
   โ”‚ request $3.00
   โ–ผ
 ALLOW
   โ”‚
   โ–ผ
 $7.00

๐Ÿ›ก๏ธ Enforcement Boundary

Assume the remaining budget is:

$7.00

The agent attempts:

$20.00

AEGIS evaluates the action before external execution:

             $7.00 AVAILABLE
                    โ”‚
                    โ”‚ REQUEST $20.00
                    โ–ผ
             โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
             โ”‚    DENY     โ”‚
             โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                    โ”‚
                    โ–ผ
             budget_exhausted
                    โ”‚
                    โ–ผ
             ๐Ÿ›‘ TOOL BLOCKED

Integration pattern:

receipt = gate.evaluar_gasto(
    agent_did=agent_id,
    operation="stripe_charge",
    tool_call_id="payment-002",
    amount_usd="20.00",
)

if receipt["policy_decision"] == "allow":
    result = execute_payment()
else:
    result = "BLOCKED"

The integration layer remains responsible for ensuring the external tool is invoked only after allow.


๐Ÿ” Idempotency & Replay Protection

AEGIS identifies an authorization using the agent and tool-call identity.

First request:

tool_call_id: payment-001
amount:       $3.00

        โ”‚
        โ–ผ
      ALLOW
        โ”‚
        โ”œโ”€โ”€ budget decreases once
        โ”œโ”€โ”€ cached: False
        โ””โ”€โ”€ signed receipt created

Exact replay:

tool_call_id: payment-001
amount:       $3.00

        โ”‚
        โ–ผ
   HISTORICAL RECEIPT
        โ”‚
        โ”œโ”€โ”€ same action_ref
        โ”œโ”€โ”€ cached: True
        โ””โ”€โ”€ NO second debit

Conflicting replay:

SAME TRANSACTION ID
        โ”‚
        โ”œโ”€โ”€ original amount: $1.00
        โ””โ”€โ”€ new amount:      $100.00
                    โ”‚
                    โ–ผ
                  DENY
                    โ”‚
                    โ–ผ
           idempotency_conflict

Validated:

Exact replay does not double-debit        PASS
Same ID + different amount blocked        PASS
Same ID + different operation blocked     PASS

๐Ÿ” Cryptographic Authorization

AEGIS signs deterministic authorization semantics rather than an unstructured success flag.

             POLICY EVALUATION
                    โ”‚
                    โ–ผ
          DETERMINISTIC PAYLOAD
                    โ”‚
                    โ”œโ”€โ”€ agent_did
                    โ”œโ”€โ”€ operation
                    โ”œโ”€โ”€ amount
                    โ”œโ”€โ”€ decision
                    โ””โ”€โ”€ tool-call binding
                    โ”‚
                    โ–ผ
                  SHA-256
                    โ”‚
                    โ–ผ
                  Ed25519
                    โ”‚
                    โ–ผ
           SIGNED POLICY RECEIPT
                    โ”‚
                    โ–ผ
                action_ref

Example receipt:

{
    "agent_did": "agent-demo-001",
    "operation": "stripe_charge",
    "amount_usd": "3.00",
    "policy_decision": "allow",
    "policy_attenuations": [],
    "policy_signature": "ed25519:...",
    "action_ref": "...",
    "cached": False
}

action_ref is represented as the 64-character hexadecimal encoding of a 32-byte SHA-256 digest.

SHA-256 digest     32 bytes
        โ”‚
        โ–ผ
action_ref         64 hexadecimal characters

๐Ÿงช Tamper Detection

Original signed authorization:

ORIGINAL PAYLOAD
      โ”‚
      โ”œโ”€โ”€ SHA-256
      โ”‚
      โ””โ”€โ”€ Ed25519
             โ”‚
             โ–ผ
           VALID โœ“

Modify signed data:

MODIFIED PAYLOAD
      โ”‚
      โ”œโ”€โ”€ different digest
      โ”‚
      โ””โ”€โ”€ original signature
             โ”‚
             โ–ผ
          INVALID โœ—

Validated:

Signature verification              PASS
Tampered authorization rejected     PASS

๐Ÿ›‘ Fail-Closed Security

AEGIS is designed to prefer denial over silent authorization when the protected authorization path fails.

          INTERNAL FAILURE
                 โ”‚
                 โ–ผ
               ๐Ÿ›‘ DENY
                 โ”‚
                 โ–ผ
         TOOL MUST NOT EXECUTE

Validated forced cryptographic failure:

BALANCE BEFORE:       10.00
DECISION:              deny
BALANCE AFTER:        10.00
BALANCE PRESERVED:     True
FAIL-CLOSED:           True
ROLLBACK:              PASS

Configured invalid-key behavior:

CONSTRUCTOR EXCEPTION: ValueError
GATE CREATED:          False

FAIL-CLOSED STARTUP:   True
EMERGENCY RECOVERY:    False
SECURITY MODEL:        INVALID KEY REJECTED

RESULT: PASS

This prevents an invalid configured cryptographic identity from being silently replaced at startup.


๐Ÿ’ฐ Financial-Loss Adversarial Matrix

AEGIS was exercised against a focused matrix of economic failure scenarios.

Scenario Result
Exact replay does not double-debit โœ… PASS
Same ID + different amount blocked โœ… PASS
Same ID + different operation blocked โœ… PASS
Signature failure preserves balance โœ… PASS
Over-budget request blocked without mutation โœ… PASS
Exact-balance authorization โœ… PASS
Zero / negative / non-numeric fail closed โœ… PASS
Excess monetary precision rejected โœ… PASS
DENY does not execute tool โœ… PASS
Signed authorization verifies โœ… PASS
Tampered receipt rejected โœ… PASS
tool_call_id changes action_ref โœ… PASS
TOTAL TESTS: 12
PASS:        12
FAIL:         0

FINAL RESULT: PASS

๐Ÿงต Concurrent Double-Spend Protection

A 1,000-request adversarial contention test was executed against a budget capable of funding only one request.

Configuration:

REQUESTS:          1,000
WORKERS:             100
INITIAL BALANCE:   $10.00
AMOUNT EACH:       $10.00

Result:

                 $10 AVAILABLE
                       โ”‚
            1,000 COMPETING REQUESTS
                       โ”‚
                       โ–ผ
                   AEGIS LOCK
                       โ”‚
                โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”
                โ”‚             โ”‚
                โ–ผ             โ–ผ
           1 ร— ALLOW      999 ร— DENY
               โ”‚
               โ–ผ
           $10 AUTHORIZED
               โ”‚
               โ–ผ
          FINAL BALANCE $0

Measured result:

Property Result
Allow 1
Deny 999
Authorized total $10.00
Final balance $0.00
Overspend NO
Result PASS

This demonstrates concurrent budget protection inside the current process-local execution model.

It does not demonstrate cross-process or distributed consensus.


๐Ÿฆ Atomic L3 Settlement

AEGIS includes an isolated L3 settlement layer that consumes a signed authorization before mutating settlement balances.

               AI AGENT
                  โ”‚
                  โ–ผ
         AEGIS AUTHORIZATION
                  โ”‚
            SHA-256 + Ed25519
                  โ”‚
                  โ–ผ
         SIGNED POLICY RECEIPT
                  โ”‚
                  โ–ผ
       โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
       โ”‚   L3 VERIFICATION    โ”‚
       โ”‚                      โ”‚
       โ”‚ โœ“ decision = allow   โ”‚
       โ”‚ โœ“ payload rebuilt    โ”‚
       โ”‚ โœ“ action_ref         โ”‚
       โ”‚ โœ“ Ed25519 signature  โ”‚
       โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                  โ”‚
                  โ–ผ
            BEGIN IMMEDIATE
                  โ”‚
            โ”Œโ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”
            โ”‚           โ”‚
            โ–ผ           โ–ผ
        DEBIT BUYER  CREDIT SELLER
            โ”‚           โ”‚
            โ””โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”˜
                  โ”‚
                  โ–ผ
          SETTLEMENT RECORD
                  โ”‚
                  โ–ผ
                COMMIT

If settlement fails after the transaction begins:

FAILURE
   โ”‚
   โ–ผ
ROLLBACK
   โ”‚
   โ–ผ
BALANCES PRESERVED

Validated L3 security matrix:

L3 Property Result
Signed settlement โœ… PASS
Conservation of value โœ… PASS
Exact replay idempotent โœ… PASS
Tampered seller blocked โœ… PASS
Tampered amount blocked โœ… PASS
Atomic rollback โœ… PASS
Concurrent limited-budget settlement โœ… PASS

Concurrent L3 test:

REQUESTS: 100

SETTLED: 1
DENIED:  99

TOTAL: 7
PASS:  7
FAIL:  0

FINAL RESULT: PASS

โšก Measured Performance

Performance is reported by execution layer.

AEGIS does not use a single latency number to represent different workloads.

Local Benchmark Environment

The following results were measured locally during the current validation run using time.perf_counter_ns().

They are local process measurements and must not be interpreted as Internet or hosted API round-trip latency.

1๏ธโƒฃ Economic Decision Primitive

Isolates local:

lock
+
Decimal comparison
+
Decimal subtraction
+
quantization
Metric Measured
Minimum 0.400 ยตs
Median 0.500 ยตs
P95 1.000 ยตs
P99 1.300 ยตs
MEDIAN = 0.000500 ms

2๏ธโƒฃ Idempotency Cache Hit

Metric Measured
Minimum 2.200 ยตs
Median 2.400 ยตs
P95 4.900 ยตs
P99 7.700 ยตs
MEDIAN = 0.002400 ms

3๏ธโƒฃ Full Signed Authorization

Includes the complete local authorization path measured by the benchmark:

validation
    โ”‚
    โ–ผ
lock
    โ”‚
    โ–ผ
idempotency
    โ”‚
    โ–ผ
budget decision
    โ”‚
    โ–ผ
deterministic payload
    โ”‚
    โ–ผ
SHA-256
    โ”‚
    โ–ผ
Ed25519
    โ”‚
    โ–ผ
receipt
Metric Measured
Minimum 45.200 ยตs
Median 47.900 ยตs
Mean 57.363 ยตs
P95 81.600 ยตs
P99 153.900 ยตs
MEDIAN = 0.047900 ms

4๏ธโƒฃ L3 SQLite In-Memory Settlement

Signed receipt verification + SQLite transactional settlement using :memory:.

Metric Measured
Minimum 133.400 ยตs
Median 146.550 ยตs
P95 245.900 ยตs
P99 393.200 ยตs
MEDIAN = 0.146550 ms

5๏ธโƒฃ L3 Local File-Backed SQLite

Signed receipt verification + local file-backed SQLite transaction.

Metric Measured
Minimum 486.600 ยตs
Median 969.200 ยตs
Mean 1.022 ms
P95 1.621 ms
P99 2.188 ms
MEDIAN = 0.969200 ms

File-backed SQLite results include the local persistence path, but should not be interpreted as guaranteed physical-disk latency for every operation because SQLite and the operating system may cache I/O.


๐Ÿ“Š Performance Summary

Layer Median P95 P99
โšก Economic decision primitive 0.500 ยตs 1.000 ยตs 1.300 ยตs
๐Ÿ” Idempotency cache hit 2.400 ยตs 4.900 ยตs 7.700 ยตs
๐Ÿ” Full signed authorization 47.900 ยตs 81.600 ยตs 153.900 ยตs
๐Ÿฆ L3 SQLite :memory: 146.550 ยตs 245.900 ยตs 393.200 ยตs
๐Ÿ’พ L3 local file-backed SQLite 969.200 ยตs 1.621 ms 2.188 ms

Relative measured cost

SIGNED / DECISION:        95.80ร—
FILE L3 / MEMORY L3:       6.61ร—
L3 MEMORY / SIGNED:        3.06ร—

๐Ÿ”ฌ Why the Latency Numbers Are Separated

A previous single latency number can hide which work is actually being measured.

AEGIS therefore reports the layers independently:

0.500 ยตs
DECISION PRIMITIVE
      โ”‚
      โ–ผ
2.400 ยตs
IDEMPOTENCY CACHE HIT
      โ”‚
      โ–ผ
47.900 ยตs
FULL SIGNED AUTHORIZATION
      โ”‚
      โ–ผ
146.550 ยตs
L3 SQLITE :MEMORY:
      โ”‚
      โ–ผ
969.200 ยตs
LOCAL FILE-BACKED SQLITE

These numbers answer different questions.

AEGIS therefore does not present 0.005 ms as a full L3 or end-to-end settlement latency claim.

The current evidence supports low-microsecond local hot paths and a sub-millisecond median for the tested local signed and SQLite settlement paths described above.


๐Ÿงฏ Benchmark Contamination Checks

The final evidence benchmark also isolates common measurement contamination.

Print overhead

Measured write to os.devnull:

NO-PRINT MEDIAN:         0.200 ยตs
PRINT MEDIAN:            2.400 ยตs
ADDED MEDIAN COST:       2.200 ยตs

Intentional sleep(0.001)

REQUESTED SLEEP:         1.000 ms
OBSERVED MEDIAN:         1.696 ms
P95:                     1.941 ms
P99:                     2.251 ms

Therefore intentional sleeps and console/debug work are kept conceptually separate from engine latency claims.


๐Ÿšซ What These Benchmarks Do NOT Measure

The current benchmark does not measure:

โœ— Client โ†’ Internet โ†’ Render โ†’ client HTTP round-trip

โœ— Multi-process coordination

โœ— Multi-worker shared-state coordination

โœ— Multi-node distributed consensus

โœ— Remote Redis coordination

โœ— Remote PostgreSQL coordination

โœ— Stripe settlement latency

โœ— Blockchain settlement latency

No number for those layers is inferred from the local benchmark.

LOCAL ENGINE PERFORMANCE
          โ‰ 
NETWORK ROUND-TRIP
          โ‰ 
DISTRIBUTED CONSENSUS
          โ‰ 
EXTERNAL FINANCIAL SETTLEMENT

๐Ÿงช Security Evidence

Current focused evidence:

โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚              AEGIS SECURITY                   โ”‚
โ”œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ค
โ”‚ Cryptographic rollback                  PASS  โ”‚
โ”‚ Idempotency conflict                    PASS  โ”‚
โ”‚ tool_call_id binding                    PASS  โ”‚
โ”‚ Invalid configured key                  PASS  โ”‚
โ”‚ Fail-closed startup                     PASS  โ”‚
โ”‚ Ed25519 verification                    PASS  โ”‚
โ”‚ Tamper detection                        PASS  โ”‚
โ”‚ DENY โ†’ tool not executed                PASS  โ”‚
โ”‚ Decimal boundary handling               PASS  โ”‚
โ”‚ Financial-loss matrix             12/12 PASS  โ”‚
โ”‚ 1,000-request double-spend              PASS  โ”‚
โ”‚ L3 settlement matrix                7/7 PASS  โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜

This evidence is intended to be reproducible from the repository rather than accepted as a marketing claim.


๐Ÿงฐ Reproduce the Evidence

Core integration:

python test_integration.py

Enforcement:

python test_enforcement.py

Concurrent budget protection:

python test_concurrency.py

Cryptographic rollback:

python test_signature_failure_rollback.py

Idempotency conflict:

python test_idempotency_conflict.py

Tool-call cryptographic binding:

python test_tool_call_binding.py

Configured-key fail-closed behavior:

python test_key_failure_behavior.py

Financial-loss adversarial matrix:

python test_financial_loss_matrix.py

1,000-request double-spend test:

python test_double_spend_1000.py

L3 settlement security:

python test_l3_settlement.py

Final layered performance evidence:

python benchmark_final_evidence.py

Expected high-level security status:

CORE SECURITY              PASS
FINANCIAL MATRIX      12/12 PASS
DOUBLE-SPEND               PASS
L3 SECURITY            7/7 PASS
PERFORMANCE EVIDENCE    COMPLETE

๐Ÿ—๏ธ Current Architecture

                         AI AGENT
                            โ”‚
                            โ–ผ
                         TOOL INTENT
                            โ”‚
                            โ–ผ
                โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
                โ”‚   ๐Ÿ›ก๏ธ AEGIS CORE     โ”‚
                โ”‚                      โ”‚
                โ”‚ Monetary Validation  โ”‚
                โ”‚ Idempotency          โ”‚
                โ”‚ Atomic Lock          โ”‚
                โ”‚ Budget Enforcement   โ”‚
                โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                           โ”‚
                    โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”
                    โ”‚             โ”‚
                    โ–ผ             โ–ผ
                  ALLOW          DENY
                    โ”‚             โ”‚
                    โ”‚             โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ–บ ๐Ÿ›‘ BLOCK
                    โ–ผ
           DETERMINISTIC PAYLOAD
                    โ”‚
                    โ–ผ
                 SHA-256
                    โ”‚
                    โ–ผ
                 Ed25519
                    โ”‚
                    โ–ผ
          SIGNED AUTHORIZATION
                    โ”‚
          โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
          โ”‚                   โ”‚
          โ–ผ                   โ–ผ
   PROTECTED TOOL       L3 SETTLEMENT
                              โ”‚
                              โ–ผ
                      VERIFY AUTHORIZATION
                              โ”‚
                              โ–ผ
                       BEGIN IMMEDIATE
                              โ”‚
                     โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
                     โ”‚                 โ”‚
                     โ–ผ                 โ–ผ
                   DEBIT             CREDIT
                     โ”‚                 โ”‚
                     โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                              โ”‚
                              โ–ผ
                            COMMIT

The authorization core and settlement layer are intentionally separated.

That separation makes it possible to benchmark, test, and reason about each boundary independently.


๐Ÿ”ฌ Current Security Model

AEGIS currently demonstrates these properties:

1. Enforce Before Execution

Authorization is produced before the integration invokes the protected external tool.

2. Atomic Process-Local Accounting

A lock protects local ledger mutation from concurrent access inside the current process.

3. Replay-Safe Authorization

Exact replay does not consume budget twice.

Conflicting reuse of transaction identity is denied.

4. Deterministic Authorization

Security-relevant authorization data is deterministically serialized before hashing and signing.

5. Cryptographic Verification

SHA-256 and Ed25519 allow downstream verification of authorization integrity.

6. Economic Rollback

Failures in protected authorization and settlement paths preserve economic state when the tested transaction must fail.

7. Atomic Local Settlement

The isolated L3 layer performs transactional buyer โ†’ seller mutation and records settlement atomically under the tested SQLite model.


โš ๏ธ Current Scope & Limitations

AEGIS Core 3.3.0 is Beta software.

Current tested scope

โœ“ Process-local authorization
โœ“ Process-local locking
โœ“ Decimal monetary accounting
โœ“ Replay-safe idempotency
โœ“ Idempotency conflict detection
โœ“ Deterministic authorization receipts
โœ“ SHA-256 action references
โœ“ Ed25519 signatures
โœ“ tool_call_id cryptographic binding
โœ“ Fail-closed authorization behavior
โœ“ Invalid configured-key rejection
โœ“ Economic rollback
โœ“ Concurrent local budget enforcement
โœ“ Atomic SQLite L3 settlement
โœ“ L3 replay protection
โœ“ L3 tamper rejection

Not currently claimed

โœ— Cross-process atomicity

โœ— Shared state across multiple workers

โœ— Multi-node consensus

โœ— Distributed ledger coordination

โœ— Redis-backed distributed locking

โœ— PostgreSQL-backed distributed settlement

โœ— Byzantine fault tolerance

โœ— Blockchain finality

โœ— Stripe settlement guarantees

โœ— Internet-scale production readiness

These are separate production/distributed-system concerns and should not be inferred from the current local evidence.


๐Ÿ”ญ Current vs Future Architecture

Current

Agent
  โ”‚
  โ–ผ
AEGIS Core
  โ”‚
  โ”œโ”€โ”€ authorization
  โ”œโ”€โ”€ budget control
  โ”œโ”€โ”€ idempotency
  โ”œโ”€โ”€ SHA-256
  โ””โ”€โ”€ Ed25519
  โ”‚
  โ–ผ
Signed Receipt
  โ”‚
  โ–ผ
Local Atomic L3 Settlement

Future / Distributed Direction

                 MULTIPLE AGENTS
                       โ”‚
                       โ–ผ
                DISTRIBUTED AEGIS
                       โ”‚
           โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
           โ”‚           โ”‚           โ”‚
           โ–ผ           โ–ผ           โ–ผ
      Shared State  Coordination  Persistence
           โ”‚           โ”‚           โ”‚
           โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                       โ”‚
                       โ–ผ
              DISTRIBUTED SETTLEMENT

The distributed architecture is a direction, not a claim about the current implementation.


๐ŸŽฏ Current Position

AEGIS is not an LLM reasoning guardrail.

It operates at the execution boundary:

              AGENT REASONING
                    โ”‚
                    โ–ผ
                 TOOL INTENT
                    โ”‚
                    โ–ผ
                 ๐Ÿ›ก๏ธ AEGIS
                    โ”‚
        โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
        โ”‚           โ”‚           โ”‚
        โ–ผ           โ–ผ           โ–ผ
     BUDGET     IDEMPOTENCY  CRYPTOGRAPHY
        โ”‚           โ”‚           โ”‚
        โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                    โ”‚
                    โ–ผ
                ALLOW / DENY
                    โ”‚
              โ”Œโ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”
              โ”‚           โ”‚
              โ–ผ           โ–ผ
        TOOL EXECUTION     L3
                       SETTLEMENT

The goal is narrow: make economically sensitive agent actions explicitly authorized, cryptographically verifiable, and testable before irreversible execution.


๐Ÿ“‹ Evidence Status

TESTED
   โ”‚
   โ–ผ
 PASS
   โ”‚
   โ–ผ
REPRODUCIBLE
   โ”‚
   โ–ผ
DOCUMENTED
   โ”‚
   โ–ผ
DEMO-READY

๐Ÿ“ฆ Package

Distribution aegis-core-lortuarte-sdk
Version 3.3.0
Python >=3.8
Status Beta
License MIT

Install:

pip install aegis-core-lortuarte-sdk

๐Ÿ“„ License

MIT License.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

aegis_core_lortuarte_sdk-3.3.0.tar.gz (25.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

aegis_core_lortuarte_sdk-3.3.0-py3-none-any.whl (18.5 kB view details)

Uploaded Python 3

File details

Details for the file aegis_core_lortuarte_sdk-3.3.0.tar.gz.

File metadata

  • Download URL: aegis_core_lortuarte_sdk-3.3.0.tar.gz
  • Upload date:
  • Size: 25.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/7.0.0 CPython/3.12.8

File hashes

Hashes for aegis_core_lortuarte_sdk-3.3.0.tar.gz
Algorithm Hash digest
SHA256 c8e4f56b91610673f995c1953d6a18965667548523010b2237654aa5ba8500e6
MD5 601d582e6c4fd4d4f6e562b09f42f172
BLAKE2b-256 20beaa6e8d20f34fe386730cf037bc4286df82cd90985ddb45c09f21a1d6348f

See more details on using hashes here.

File details

Details for the file aegis_core_lortuarte_sdk-3.3.0-py3-none-any.whl.

File metadata

File hashes

Hashes for aegis_core_lortuarte_sdk-3.3.0-py3-none-any.whl
Algorithm Hash digest
SHA256 8782115bfd4499669d7a8609bf04e7376d3c93edd1ad025eb9ac4755b9004875
MD5 a056ef3f1cac27a014c0aa2f0413fc3a
BLAKE2b-256 0ca885dde8567a4e99f7f023130229f3ac978aedd385ac6c1262f940b78f68fc

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page