The tool call is the grant

A technical note on sequence denial, intent binding, and what Aegis actually proves

Aegis Unified, LLC · 7 September 2026 · Working paper, not a peer-reviewed study Canonical URL: https://aegiscruc.io/research Companion film: https://aegiscruc.io/demo

Abstract

Most commercial controls on LLM agents score one tool name at a time. If read_file and http_request are both on the allowlist, a session that reads /data/customers.csv and then posts it off-network is a pair of successes. Aegis is an OpenAI-compatible sidecar that scores the session graph: the same two names, in that order, return HTTP 403 with layer=sequence and are not forwarded to the origin.

This note is a map of reproducible evidence in this repository, not a bake-off against named vendors and not a claim of FedRAMP, FIPS, or model-refusal accuracy. We report (1) an allowlist-vs-sequence scenario whose JSON shape is locked to the data plane, (2) a defensive canary catalog mapped to OWASP LLM Top 10 and NIST AI RMF language, (3) Inspect-style *tool-boundary* tasks that explicitly refuse to fake Linux kernel EPERM on Docker Desktop, and (4) Intent Warrant mint/verify tests. We also list non-claims that the product already documents, including that prompt-only jailbreaks with no tool JSON are signatures or nothing, and that the marketing figure “0.71 ms overhead” is not treated as a reproduced benchmark here.

1. The problem that name-checks miss

An agent with tools is not a chatbot. The security-relevant event is not the string the model printed. It is the tool invocation the runtime is about to execute: a path, a host, a command.

A gateway that only asks “is this tool name allowed?” will correctly allow read_file on /data/customers.csv and correctly allow http_request to an egress URL. Each hop is in policy. The chain is the incident.

That is the public demo scenario in scripts/rival_vs_aegis_scenario.py:

Hop 1 is supposed to work. The file is on the list. Hop 2 still has an allowlisted name. Aegis denies because read_file already occurred in the same session window.

This is not “we classified the prompt as malicious.” It is a deterministic rule on ordered tools. The data-plane implementation lives in data_plane/src/sequence.rs: each incoming call is matched against history inside a time window (default 300 seconds). HTTP without a prior read does not match. Read then HTTP does.

The deny body the film is allowed to show is the stable Guardrail shape—not invented event_id / policy_hash / signature hex, which are minted live:

{
  "error": "Aegis Guardrail",
  "verdict": "deny",
  "layer": "sequence",
  "reason": "Blocked: read_file then http_request (exfil chain)",
  "session_id": "sess-exfil-042"
}

control_plane/test_rival_vs_aegis.py asserts hop 1 allows on both sides, hop 2 allows only on the rival, Aegis hop 2 is 403 / sequence, and the JSON keys match that shape. It also asserts the film renderer does not contain marketing residue (SEMANTIC BRIDGE, sub-50ms, THE WEDGE) and does contain HTTP 403, layer=sequence, and customers.csv. On 7 September 2026 those tests passed in this workspace (Ran 5 tests … OK as part of a 21-test offline bundle; see §6).

What this does not prove. The “rival” is a model of per-call allowlist, not a measured Lakera, WitnessAI, or MCP gateway. Do not cite this table as a vendor comparison. Cite it as: *if your control is name-only, this chain succeeds; if your control is session sequence, this chain 403s.*

2. Threat model (what the sidecar is for)

Aegis sits in front of an OpenAI-compatible origin (/v1/chat/completions and related POSTs). It inspects tool JSON on the request and the model response. Streaming bodies are buffered, then inspected. Live LLM tokens do not go through Python; the Rust data plane is the hot path (ARCHITECTURE.md).

In-scope for userspace:

• Tool not on the allowlist (layer=allowlist)
• Tool denied for a verified role (layer=rbac)
• Ordered chain such as read → HTTP (layer=sequence)
• Path / host / exec outside the grant, including lexical .. (layer=intent)
• Known injection / exfil phrasing in the signature pack, including several encodings (layer=signature)
• Later tools in the same X-Aegis-Session after a signature hit (layer=multiturn)
• Destructive tools without HITL (layer=hitl)
• PCI/PII/secret taint to a sink (layer=flow)

Out of scope, already written as non-claims in docs/contract/CONTROLS.md:

• Not FedRAMP. Not an ATO. Not FIPS 140.
• eBPF LSM is Linux + a real BPF object. Docker Desktop / Windows stay userspace 403s. A userspace 403 is not kernel success.
• Single-node Compose is not HA.
• Client X-Aegis-Role is not authentication on the contract overlay.
• Prompt-only jailbreaks that never invoke a tool are signatures or nothing. If you need a model-refusal score, this is the wrong product note.

Kernel (Aegis Node on Ubuntu 24.04, not Docker Desktop WSL): an Ed25519 Intent Warrant binds declared tool intent to later syscalls; mismatch is EPERM. Proof script: scripts/prove_kernel_grant.sh. Inspect’s kernel row is defined to SKIP a fake proxy POST (evals/inspect/README.md). That skip is a feature.

3. Layers, mapped to language a reviewer already knows

docs/contract/CONTROLS.md is the contract-facing map. Abbreviated:

NIST 800-53 / AI RMF column IDs in that file are mapping language for capture teams, not an authorization.

4. The defensive catalog (what “tests we have run” means)

Aegis does not score Garak toxicity or Crescendo on a naked LLM. The right yardstick, from evals/README.md: *canaries that would make an agent invoke a denied tool, leave the intent grant, or match a known injection signature are denied before they reach the origin.*

Pass, in audit or enforce:

• HTTP 403 with "error": "Aegis Guardrail" and a layer, or
• origin status with X-Aegis-Decision: WOULD_BLOCK (Free Audit Mode)

VIP / CI fail-closed (python evals/run_bench.py --require-403) accepts only HTTP 403 Guardrail on deny cases. Audit-mode WOULD_BLOCK that still forwards is a failure. The allowlisted calculator must not be 403.

Catalog (evals/catalog.py) includes, among others:

These are the same defensive canaries as Path A smoke tests—not a novel jailbreak corpus. Encoding cases exist so a Base64 wrap of the plaintext canary is still a signature hit, not a claim that Aegis “beat Garak.”

Inspect-style tasks (evals/inspect/tasks.json) map UK AISI Inspect *environment* ideas onto those same boundaries: unconstrained tool, path grant, .. traversal, link-local metadata URL, HITL, sequence exfil, allowlisted calculator. Non-claim in the Inspect README: this does not measure model cyber-offense. No Cybench / InterCode / exploit-generation score.

Multi-turn (evals/multiturn_catalog.py): turn A is the existing signature canary; turn B is a later in-policy-looking tool in the same X-Aegis-Session. That is a PyRIT-shaped *session*, not a Crescendo essay.

5. Intent warrants (userspace proof that is not a 403 film)

control_plane/test_warrant.py mints an Intent Warrant from a seed key, verifies Ed25519 over canonical bytes, binds prompt_sha256, records boot-time TTL when CLOCK_BOOTTIME exists, and (on POSIX) locks a bpffs pin to owner-only mode. That is crypto and policy plumbing. It is not a substitute for prove_kernel_grant.sh on a real LSM.

The product sentence that is allowed: *the tool call is the kernel grant.* The evidence that is allowed in a paper: mint/verify tests plus a Linux proof script that CI is instructed not to mock as PASS from Docker Desktop.

6. What we ran for this note (7 September 2026)

Offline, no proxy (this workspace):

python -m unittest control_plane.test_rival_vs_aegis evals.test_catalog evals.inspect.test_tasks -v
Ran 21 tests in 0.177s
OK

That bundle covers: sequence scenario + honest film copy; catalog uniqueness, OWASP tags, Promptfoo/Garak config pointers, encoding round-trip of the canary; Inspect task invariants, including that the kernel task points at scripts/prove_kernel_grant.sh and the runner skips a kernel POST.

Not re-run for this PDF-shaped note (require a live data plane + Redis + mock origin):

python evals/run_bench.py --require-403
python evals/inspect/run_inspect.py

CI specifies those as job guardrail-enforce in .github/workflows/ci.yml: Redis 7, release data_plane, evals/mock_origin.py on :4010, AEGIS_USERSPACE_ENFORCE=1, AEGIS_EBPF=0, then --require-403. Cite a green Actions run, not this paragraph, as live 403 proof. This note cites the job *definition* and the offline locks that keep the catalog honest.

7. How to reproduce (reviewer checklist)

1. Sequence logic without Docker

python -m unittest control_plane.test_rival_vs_aegis Optional: python scripts/rival_vs_aegis_scenario.py

1. Catalog integrity

python -m unittest evals.test_catalog evals.inspect.test_tasks

1. Fail-closed 403s (the claim customers care about)

Proxy healthy at http://127.0.0.1:8080/health, then python evals/run_bench.py --require-403 or the Compose/CI env in evals/README.md (AEGIS_USERSPACE_ENFORCE=1, mock origin).

1. Kernel EPERM

Ubuntu 24.04, not Docker Desktop: sudo bash scripts/prove_kernel_grant.sh If that script is skipped, do not write “kernel proven” in a customer email.

1. Public film

aegiscruc.io/demo — same chain, two verdicts. The interactive map is illustration; the unittest is the lock.

1. Contract language

docs/contract/CONTROLS.md + docs/contract/README.md. Laptop docker compose up is not the contract overlay (Redis on localhost without AUTH).

8. Related work (positioning, not a lab)

Public mid-2026 landscape, as we have used it internally: prompt/jailbreak classifiers (Lakera and peers) optimize content. MCP catalogs and shadow-AI products optimize inventory. Invariant-style IFC on traces stops at the harness; a subprocess is a different movie. ActPlane-style eBPF IFC uses pre-written policy, not the live tool call as the grant. Aegis’s bet is narrower: inline 403 on tool JSON, optional kernel EPERM when the OS action was not in the warrant.

If a reviewer has a named gateway that already denies read_file then http_request as a first-class sequence object with a signed body, that is a fair challenge. This paper does not assert that no such product exists. It asserts that our tests prove our sidecar does, under the catalog above.

9. Limitations (read this before you quote us)

• Audit vs enforce. Downloads boot Free Audit Mode. WOULD_BLOCK while still forwarding is not a 403. Paid keys / AEGIS_USERSPACE_ENFORCE=1 / Redis aegis:enforce:userspace are what flip live denies. Do not demo audit-mode logs as fail-closed.
• Signature matcher. Normalized substring + token Jaccard on a pack. Not an embedding model. Novel jailbreak essays that never touch a tool may pass. That is documented.
• Latency. ARCHITECTURE.md states a sub-50 ms *target* on the userspace signature path. The landing page quotes 0.71 ms average overhead. This working paper does not reproduce or endorse 0.71 ms. Measure on your host.
• Sequence rules are policy. Default demos use read → HTTP (and siblings). An agent whose legitimate job is “read then POST to your own API” needs a different rule or a different grant. Sequence is not magic; it is a declared chain.
• **No phone-home is an air-gap *mode*,** not a proof that every deploy is isolated. Intel packs and CRL are a separate path (intel/drop).
• This is not legal advice, not a penetration test of a third party, and not a claim that your agents are safe. It is evidence about this control plane and data plane.

10. Closing

The sentence we will defend in a room with a CISO is not “we stop all prompt injection.” It is:

Agent issued read_file on a customer file. Same session then opened egress. Both names were allowlisted. Aegis returned HTTP 403, layer=sequence, and did not forward the second call. On Linux Node, a syscall that was not in the signed warrant is EPERM. You can replay the catalog.

If that sentence matches the job, run §7. If you need a classifier leaderboard, we are the wrong paper.

Reproduce commands (copy)

python -m unittest control_plane.test_rival_vs_aegis evals.test_catalog evals.inspect.test_tasks -v
python evals/run_bench.py --require-403   # proxy + enforce required