Demonstration onlineVersion 0.15.0Profile aegis-jcs-1Byss Labs

One decision.Five gates.Never the keys.

A security AI proposes to isolate a host. AEGIS decides whether it may, without ever holding the keys itself, and hands you a receipt you verify at home, without taking our word for it.

See a real transaction, replayed Verify a receipt without AEGIS

Think of a payment terminal: it has neither your money nor your card, it knows only the transaction. It accepts or refuses it, and prints a ticket. AEGIS is that terminal, for the actions of a security AI.

Action finality protocol · five gates, in this order, none skippedGate 1 is live when a session opens

Gate 1 / 5FrameA signed mission fixes the scope, the deadline and the risk budget. Nothing that follows can widen them.Refusesany action outside the closed list, however well meant.
Gate 2 / 5ProveTwo observations from distinct failure domains. Two reports from the same source do not corroborate each other.Refusesevidence that is empty, stale or out of scope.
Gate 3 / 5ValidateA human signs, then code re-reads the rule and the exact state of the target, twice, by two evaluators.Refusesa target that is not the one that was examined.
Gate 4 / 5ActA single-use authority, bound to the examined state. If the target changed by one byte, it is worth nothing.Refusesany move without a signed token for this exact action.
Gate 5 / 5RestoreThe return is a persisted obligation, not an intention. On failure: bounded retries, then a human.Refusesan action whose return was not planned before the first move.

5gates, always in the same order

2possible actions, both reversible and bounded

2verifier implementations, without one shared line of code

18routes attempted by an adversarial agent, over HTTP, with a plain operator identity

0independent audits to date. It says so here, and on every page.

The dossier · seven exhibits · each opens onto paper

Exhibit01

The problem we take on

A security AI allowed to act is an AI that can be wrong with your keys.

OpenClose

Security agents already know how to propose containment: isolate a host, drain a node, cut an access. The question is no longer "can it do it?" but "who authorised it, on what evidence, and how do we undo it?"

Today the answer is a log only the vendor can read. AEGIS replaces that answer with a transaction: a decision made by deterministic code, sealed, and a receipt you verify at home.

Question	Usually	With AEGIS
Who decides?	A model, or a rule buried in the tool.	Deterministic code, re-read by a second evaluator.
On what evidence?	"The model found it suspicious."	Two observations from independent sources, referenced in the receipt.
And the rollback?	By hand, if someone remembers.	An obligation recorded before the action, retried, then escalated to a human.
What remains afterwards?	A proprietary log.	A signed capsule, a transparency log, an independent verifier.

What it is not

Not an antivirus. AEGIS detects nothing. It sits above: between an AI that proposes a containment action and an infrastructure that can be changed.

Exhibit02

How it works

Five gates, in order, no shortcut. Only two actions, and their return planned before the first move.

OpenClose

An AEGIS session is a transaction. It starts with a mission and ends with a receipt; in between, each gate opens only once the previous one has closed.

Frame. An operator signs a mission: the closed list of permitted actions, the scope, the deadline, the risk budget. Any action missing from the list is refused at the boundary, before it is even examined.
Prove. The AI justifies the action with observations, never with its opinion. Two are needed, from different failure domains: a sensor and its copy do not count twice.
Validate. A human approves. Then the kernel re-reads the rule and the exact state of the target, and a second, independent evaluation must say the same thing.
Act. A dedicated executor, with minimal rights, receives a single-use token bound to the examined state. An executor can only receive the actions meant for it.
Restore. The return is a persisted obligation. It is attempted, retried within fixed bounds, then escalated to a human if it still fails.

Two actions, and not one more

Temporarily isolate a workload, or temporarily take a node out of scheduling. No deletion, no encryption, no account lockout: that is the product, not a provisional limit. Each of the two actions has its reversibility contract, written before it exists.

What gate 4 does not do

AEGIS never connects to your infrastructure itself. It holds no production credential. The move is made by a separate executor, and the token it receives is valid for this target, in this state, once.

Exhibit03

What you receive

A receipt other tools read, a log you consult without an account, and a verifier that is not ours.

OpenClose

You receive	In what form	Who can read it
The receipt for each action	A SCITT capsule (IETF draft), a COSE_Sign1 envelope signed with Ed25519	Any COSE library, not only ours
Proof that the receipt is recorded	An inclusion path in a Merkle tree (RFC 6962)	A browser, which recomputes it; the verifier
The build's provenance	The SBOM digest and the provenance pointer, inside the capsule	Your supply-chain tooling
The verifier	A Rust binary shipped with every release, with a SHA256SUMS manifest	You, without AEGIS, without a network

Why a second implementation

The Rust verifier shares no line with AEGIS and decodes the envelopes with third-party libraries. If our encoders were wrong, it would say so. "Trust us" is the sentence the product refuses to say.

Known limit

The transparency log's inclusion receipt is not in the standard IETF format. It carries its own type, precisely so it cannot be mistaken for what it is not.

Exhibit04

Why believe this page

Because it does not ask you to. Everything claimed here was measured, and the command that reproduces it is published.

OpenClose

Every test is proven by mutation. The protection it guards is removed, and the test must fail. Several did not at first writing; that is what was fixed.
Every hand-written encoder is re-read by something other than AEGIS. The RFC 8949 corpus, the Rust verifier, and five forged envelopes that must be refused.
The formal model (Quint, checked by Apalache) explores the interleavings: failures, stale state, emergency stop. Real traces are replayed against it.
An adversarial agent, over HTTP, with a plain operator identity, attempts eighteen routes. The positive control passes first: a table of refusals produced by a harness that never reaches the product is worth nothing.
This site itself is assembled from the repository. Any broken internal link fails the publication; so does any page without the "demonstrator" line. The receipt at the bottom of the page is its own.

The detail, with the commands that reproduce each figure, is in the documents and the changelog.

Exhibit05

What this site does not prove

Four things, said in the same place as everything else, so you do not have to look for them.

OpenClose

No independent audit. The methods in exhibit 04 prove internal consistency and conformance to specifications. They do not replace a third-party assessor, who has not been through.
No production system. Two actions qualified on a disposable cluster; none on a real one. The demonstration runs in a local simulator.
The repository is private. Links to the code and to release artefacts return 404 without read access. Nothing in the verification asks you to trust AEGIS, but today it takes access to run it.
The inclusion receipt is not in the standard IETF format. See exhibit 03. The day it is, this line goes away, and the changelog will say when.

Exhibit06

For whom, and for what

Three readers, three uses. None of them needs to believe us.

OpenClose

You are	What AEGIS brings you	Where to start
CISO, SOC lead	A frame for letting an AI propose containment without handing it the keys, with a rollback that is not a promise.	The theory (in French)
Vendor of a security AI	An authorisation and evidence layer to place under your agent, with a documented protocol and a receipt format others read.	The protocol, the SCITT capsules
Assessor, auditor	A reproducible dossier: commands, vector corpus, independent verifier, and the explicit list of what is not covered.	The audit package, the threat model

The compliance document (in French) says, obligation by obligation, which AEGIS artefact counts as evidence, and which obligations are not covered. It never says "compliant".

Exhibit07

Getting started

Three ways to look under the hood without installing anything. Then an address.

OpenClose

Watch the demonstration. A real transaction, replayed gate by gate, every value from a captured run. Open the demonstration (in French).
Read the architecture. The kernel, the executors, the stores and the boundaries between them. Read.
Verify a receipt yourself. The independent verifier, the corpus and the manifest. Today this takes access to the repository. How.
Talk to us. The framing, the market and the regulatory calendar are in the full dossier on byss-group.com (in French).

If you have read this far, you just did what AEGIS asks of an AI: pass the gates in order, without skipping one.