AEGIS

A coding agent is one of the most dangerous things to hand autonomy to: it runs commands, edits files, reads secrets, makes network calls and installs dependencies. Every leading tool treats that risk as a UX problem — a confirmation prompt bolted onto an agent that otherwise has full reach of your machine.

We wanted the opposite, and for our own client work: a coding agent we could point at a real repository and still prove, afterwards, exactly what it did — with destructive actions, secret exfiltration and prompt injection structurally prevented, not politely discouraged.

And it had to stay neutral and cheap: any cloud model via bring-your-own-key with zero markup, or fully local via Ollama at zero token cost — no vendor lock-in and no per-seat platform tax.

We wrote a full build specification, then built the safety kernel first — deliberately, before the agent. AEGIS runs the model inside concentric rings: the LLM only emits intents; the Aegis Layer (policy engine, sandbox broker, consent gateway, secrets firewall, audit ledger and kill switch) authorises, sandboxes and logs every one before any effect reaches the host. The agent core holds no syscall capability of its own — only a handle to the broker.

Ten principles are enforced architecturally, not by convention: a hard instruction/data boundary (everything the agent reads is untrusted data, never commands); least-privilege capability tokens; tiered consent (Auto / Confirm / Forbidden); kernel-level sandboxing (Seatbelt on macOS — the supported platform) with deny-by-default network egress; a secrets firewall the model can't read; and a tamper-evident, hash-chained audit ledger that replays any session end to end.

We shipped it two ways. CIARUSTCODE is the native implementation — an eight-crate, ~45,000-line Rust workspace compiling toward a single auditable 17 MB binary, with 394 workspace tests (140 on the safety layer alone). CIACODE is the pragmatic "OpenCode Wrap Edition" — it leaves the open-source OpenCode agent unmodified and contains it from the outside with the OS, Docker, an egress proxy and the same tamper-evident ledger.

AEGIS exists as a working safety architecture with two implementations, both built for Consultancy in Action and both red-teamed against their own threat model — destructive actions, prompt injection, secret exfiltration and runaway autonomy. It runs any cloud model via BYOK with zero markup, or fully local via Ollama at $0 token cost. In July 2026 it gained semantic memory recall, auto-injected skills, named resumable sessions and read-only explorer subagents — each capability attested in the same tamper-evident ledger, so "what did the agent remember, load or delegate, and why" is a verifiable query, not a mystery.

Commissioned cold, security-grade tooling like this — a Rust safety kernel with kernel-level sandboxing, a secrets firewall and a tamper-evident ledger — is a £130k–£245k specialist build over six to twelve months. We designed and built ours AI-accelerated, in about five weeks — a fraction of that time.

That's the real proof point. Our website shows we ship marketing-grade web fast; AEGIS shows we ship governed, auditable, security-grade AI infrastructure fast — which is exactly what we sell. And the audit ledger means that when we run an agent on your codebase, you get a record that proves precisely what it did. AEGIS is source-available under the PolyForm Noncommercial 1.0.0 licence — free for personal, research, education, nonprofit and government use, with commercial use licensed by Consultancy in Action.