Paper proposes Aegis runtime governance system to constrain agentic AI tool use

Agentic AI systems increasingly request tool actions that modify files, send messages, launch jobs, or alter workflow state, shifting safety concerns from harmful text generation to harmful operational side effects. Prompt-level governance can shape model behavior but does not create an execution boundary.

The paper introduces Aegis, a runtime governance system that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. Under this model, the AI model proposes actions while the trusted runtime decides whether to allow them.

Aegis evaluates proposals against active policy state, resolves provenance server-side, and enforces fail-closed execution under uncertainty. Selected cases are routed through Senate-style settlement, a quorum-based non-unilateral authorization path that requires a final signed tally.

The system was evaluated on a repeated sandbox corpus spanning five run families, 42 tasks, three conditions, and ten repeats per family. Across 6,300 rows with prompt-policy conditioning, researchers observed 79 risky comparator-path leakage rows. Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions.

All 1,832 Aegis-attempted governed rows preserved trusted Aegis-resolved provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. The authors emphasize that these results do not prove general autonomous-agent safety but support the narrower claim that runtime action-boundary governance prevented observed risky proposals from becoming governed side effects in this evaluated sandbox corpus.