Security Model

Aegis is designed around supervised automation, explicit policy classes, and local control.

Security Posture

Aegis is a local-first harness. Its default security model assumes one operator running Aegis on their own machine, with optional private-network access only when the operator deliberately configures authentication and network exposure.

Aegis is not currently positioned as a public internet service, multi-tenant SaaS platform, or delegated enterprise approval system. Those modes require separate hardening tracks for authentication, CSRF/session handling, secret management, role-based approval delegation, deployment isolation, backups, and operational monitoring.

The detailed architecture threat model is in Threat Model.

Localhost By Default

The local Aegis server binds to localhost by default. Binding beyond localhost requires bearer-token authentication.

Localhost should still be treated as a browser-facing boundary. The hardening roadmap tracks origin/CSRF protections for state-changing local API calls so the local dashboard remains safe against unintended cross-site requests from other local browser pages.

Human-Owned Approvals

The coordinator can recommend actions, but high-risk approvals remain human-owned. Approval evidence should include the action type, policy class, risk, reason, related run, artifacts, traces, and verifier context.

Repo Writes

Repo writes use exact patch-bundle approval. An approval does not grant broad file mutation rights.

Secrets

Secrets are stored through the local secret registry. API responses expose redacted metadata, not raw secret values.

The current default secret store is local and file-backed. This fits the personal/local operating mode, but it is not a replacement for an enterprise secret manager. Future hardening should add stronger at-rest protection, clearer secret-read audit trails, rotation support, and optional OS keychain or external secret-manager integrations.

Model-provider CLI subprocesses receive a bounded environment instead of the operator’s full shell environment. Aegis inherits only runtime basics and provider CLI config-home variables, then overlays explicit provider credentials resolved from the secret registry.

Connector writes prefer typed operations with clear scopes and receipts. Generic OAuth API request tools are advanced escape hatches; unsafe methods require a matching approval preview before Aegis reads OAuth tokens or contacts the provider.

Hardening Roadmap

The current local-first hardening direction is summarized in this public security model and the detailed architecture threat model.

Near-term security priorities:

• emit live events directly through a push-capable event bus instead of polling;
• add runtime isolation enforcement for tools, connectors, and network egress;
• document connector enablement checklists for purchases, trades, tax, device/network actions, and self-extension.

Reporting Vulnerabilities

Do not open public issues for suspected vulnerabilities. Follow the repository security policy.