The tool call is the grant

Abstract

Most commercial controls on LLM agents score one tool name at a time. If read_file and http_request are both allowlisted, a session that reads /data/customers.csv and then posts it off-network is two successes. Aegis is an OpenAI-compatible sidecar that scores the session graph: the same two names, in that order, return HTTP 403 with layer=sequence and are not forwarded.

This is a map of reproducible evidence in the Aegis repository, not a bake-off against named vendors, and not FedRAMP, FIPS, or a model-refusal leaderboard. Prompt-only jailbreaks with no tool JSON are signatures or nothing. The marketing figure “0.71 ms overhead” is not treated as a reproduced benchmark in this note.

1. The hop name-checks miss

The security-relevant event is the tool invocation the runtime is about to execute. A name-only gateway correctly allows both hops. The chain is the incident. Scenario: scripts/rival_vs_aegis_scenario.py. Lock: control_plane/test_rival_vs_aegis.py. Implementation: data_plane/src/sequence.rs (history inside a time window; HTTP without a prior read does not match).

The “rival” is a model of per-call allowlist, not a measured Lakera or WitnessAI. Do not cite the table as a vendor comparison.

{
  "error": "Aegis Guardrail",
  "verdict": "deny",
  "layer": "sequence",
  "session_id": "sess-exfil-042"
}

On 7 September 2026 this workspace ran python -m unittest control_plane.test_rival_vs_aegis evals.test_catalog evals.inspect.test_tasks -v: 21 tests, OK. That includes hop1 allow / hop2 Aegis-only deny, Guardrail JSON shape, and a check that the public film copy stays honest (no leftover marketing slogans).

2. Threat model

Rust data plane on the hot path; Python is not in live token forwarding (ARCHITECTURE.md). Tool JSON is inspected on request and completion. Streaming is buffered, then inspected.

In-scope userspace layers: allowlist, RBAC, sequence, intent (including lexical ..), signature pack, multi-turn taint, HITL, flow/taint. Kernel EPERM is Linux Node + scripts/prove_kernel_grant.sh. Docker Desktop is userspace 403s only. A userspace 403 is not kernel success. Inspect’s kernel row is defined to skip a fake proxy POST.

Contract mapping: docs/contract/CONTROLS.md. Laptop docker compose up is not the contract overlay.

3. Defensive catalog

Right yardstick (evals/README.md): canaries that would invoke a denied tool, leave the grant, or match a known signature are denied before the origin. Fail-closed VIP: python evals/run_bench.py --require-403 — audit-mode WOULD_BLOCK that still forwards is a failure. calculator must not 403.

Inspect-style tasks (evals/inspect/tasks.json) map those same canaries onto tool-boundary analogues. They do not measure model cyber-offense (no Cybench / exploit-generation score). Signatures are substring + token Jaccard on a pack, not an embedding model.

4. Warrants and CI

control_plane/test_warrant.py mints and verifies Ed25519 Intent Warrants over canonical bytes. That is plumbing, not a filmed LSM deny. CI job guardrail-enforce (.github/workflows/ci.yml) builds the data plane, starts a mock origin, sets AEGIS_USERSPACE_ENFORCE=1, and runs --require-403. Cite a green Actions run as live 403 proof; this page cites the job definition plus the offline locks.

5. Reproduce

python -m unittest control_plane.test_rival_vs_aegis evals.test_catalog evals.inspect.test_tasks -v
python evals/run_bench.py --require-403
sudo bash scripts/prove_kernel_grant.sh   # Ubuntu 24.04, not Docker Desktop

6. Limitations (quote these)

• Free Audit Mode can log WOULD_BLOCK and still forward. That is not fail-closed.
• Sequence rules are policy. A legitimate “read then POST to your API” needs a different grant, not a slogan.
• Novel jailbreak essays that never touch tool JSON may pass the signature pack. Documented in CONTROLS.md.
• Do not cite 0.71 ms from this paper. Architecture target is sub-50 ms on the userspace signature path; measure locally.
• Not an ATO. Not a third-party pentest. Not “your agents are safe.”

The sentence we will defend: the agent issued read_file on a customer file; the same session then opened egress; both names were allowlisted; Aegis returned HTTP 403, layer=sequence, and did not forward the second call. On Linux Node, a syscall outside the signed warrant is EPERM. You can replay the catalog.