Infocion Aegis SDK

Governance for AI agents: an allow-listed tool-call guard, brokered short-lived credentials, rule-based PHI redaction, human-in-the-loop approval, and a tamper-evident audit trail — wrapped around an agent you already have.

pip install infocion-aegis

The distribution is infocion-aegis; the import is aegis_sdk.

If you meant a different Aegis: several similarly named packages on PyPI are unrelated products with no connection to the Infocion Aegis control plane. This one exposes guard, aegis_session and context_from_env, and has no MetricsReporter and no AuditLog — if your code uses either of those, it is not this package, which is why nothing reaches your console.

Quick start

Two environment variables, from your agent's page in the Aegis console:

export AEGIS_API_BASE=https://your-aegis-host/api/aegis
export AEGIS_AGENT_KEY=agk_...       # Agents → your agent → Enrollment keys
export AEGIS_ENFORCEMENT=development # or 'governed' — see below

Then decorate the tool functions your agent already calls:

from uuid import uuid4

from aegis_sdk import guard
from aegis_sdk.guard import aegis_session
from aegis_sdk.platform import context_from_env

ctx = context_from_env(session_id=str(uuid4()))


@guard(tool_name="query_trials", connector="clinicaltrials-gov", scope="read")
def query_trials(condition: str, *, aegis_cred=None) -> list[dict]:
    # If this connector is not bound to this agent, the call is BLOCKED and
    # logged — not silently dropped, and not allowed through with a warning.
    return ctms.search(condition=condition, token=aegis_cred.secret)


with aegis_session(ctx):
    results = query_trials("type 2 diabetes")

Your agent's graph, prompts and state are untouched. LangGraph, LangChain, CrewAI or plain Python all work the same way.

What it does on every guarded call

1. Allow-list — is this connector registered and bound to this agent?
2. Autonomy tier — may this agent execute at all, or only observe?
3. Policy — does the decision point permit this action at this scope?
4. Credential — a short-lived, task-scoped token issued per call.
5. Audit — allowed or blocked, a hash-chained record is written either way.

A blocked call raises. It never returns None, because an agent that treats a governance refusal as an empty result will carry on reasoning from it.

Development vs governed

pip install alone does not make an agent contained. On a laptop or ordinary VPS the process can reach a model provider directly — import openai bypasses any decorator — so that mode is development and the console shows the agent as UNATTESTED. It is fully registered, policy-checked and audited; it is not contained.

A governed deployment runs the agent inside a network whose egress is restricted, so the only route out is the gateway. The SDK verifies this at startup and refuses to run if it is false.

Use development mode to build and test. Do not put real PHI through it.

Tracing

Spans go to a collector you run, in your own environment. Aegis's cloud has no span ingest and will not be given one — a span is a PHI surface, because the search criteria in a database-query span are the patient criteria.

Tracing is off until you turn it on. A process that never calls configure_tracing() gets OpenTelemetry's no-op tracer and records nothing: nothing emitted, nothing buffered, nothing dropped.

from aegis_sdk import configure_tracing, flush_tracing

configure_tracing(service_name="my-agent")   # once, at startup
...
flush_tracing()                              # before the process exits

AEGIS_OTLP_ENDPOINT defaults to http://phoenix:6006, which is a client-zone Docker hostname — it resolves inside the client-zone bundle and nowhere else. To trace during development, run your own collector and point the SDK at it:

docker run -d --name phoenix -p 6006:6006 arizephoenix/phoenix:latest
export AEGIS_OTLP_ENDPOINT=http://localhost:6006

Skipping that is fine; the exporter will simply warn on every export that the host is unreachable. Leaving tracing off costs nothing in the console — sessions, token counts, redaction tallies and guard decisions travel over your agent key independently of OpenTelemetry.

Extras

Documentation

Full integration guide, including the audit action vocabulary, custody tiers and failure modes, is downloadable from the SDK & Integration page of your Aegis console.