Infocion Aegis SDK

Governance for AI agents: an allow-listed tool-call guard, brokered short-lived credentials, rule-based PHI redaction, human-in-the-loop approval, and a tamper-evident audit trail — wrapped around an agent you already have.

pip install infocion-aegis

The distribution is infocion-aegis; the import is aegis_sdk.

If you meant a different Aegis: the name aegis-sdk on PyPI belongs to an unrelated PII-masking product from aegispreflight.com. It is not this package and has no connection to the Infocion Aegis control plane. If your code uses aegis_sdk.metrics.MetricsReporter or aegis_sdk.audit.AuditLog, you have that one — neither exists here.

Quick start

Two environment variables, from your agent's page in the Aegis console:

export AEGIS_API_BASE=https://your-aegis-host/api/aegis
export AEGIS_AGENT_KEY=agk_...       # Agents → your agent → Enrollment keys
export AEGIS_ENFORCEMENT=development # or 'governed' — see below

Then decorate the tool functions your agent already calls:

from uuid import uuid4

from aegis_sdk import guard
from aegis_sdk.guard import aegis_session
from aegis_sdk.platform import context_from_env

ctx = context_from_env(session_id=str(uuid4()))


@guard(tool_name="query_trials", connector="clinicaltrials-gov", scope="read")
def query_trials(condition: str, *, aegis_cred=None) -> list[dict]:
    # If this connector is not bound to this agent, the call is BLOCKED and
    # logged — not silently dropped, and not allowed through with a warning.
    return ctms.search(condition=condition, token=aegis_cred.secret)


with aegis_session(ctx):
    results = query_trials("type 2 diabetes")

Your agent's graph, prompts and state are untouched. LangGraph, LangChain, CrewAI or plain Python all work the same way.

What it does on every guarded call

1. Allow-list — is this connector registered and bound to this agent?
2. Autonomy tier — may this agent execute at all, or only observe?
3. Policy — does the decision point permit this action at this scope?
4. Credential — a short-lived, task-scoped token issued per call.
5. Audit — allowed or blocked, a hash-chained record is written either way.

A blocked call raises. It never returns None, because an agent that treats a governance refusal as an empty result will carry on reasoning from it.

Development vs governed

pip install alone does not make an agent contained. On a laptop or ordinary VPS the process can reach a model provider directly — import openai bypasses any decorator — so that mode is development and the console shows the agent as UNATTESTED. It is fully registered, policy-checked and audited; it is not contained.

A governed deployment runs the agent inside a network whose egress is restricted, so the only route out is the gateway. The SDK verifies this at startup and refuses to run if it is false.

Use development mode to build and test. Do not put real PHI through it.

Extras

Documentation

Full integration guide, including the audit action vocabulary, custody tiers and failure modes, is downloadable from the SDK & Integration page of your Aegis console.