AegisSwarm-Core | Zero-Trust Security for Multi-Agent AI

Why AegisSwarm-Core

Multi-agent systems plan, delegate, and call tools without per-step human oversight. That creates an execution-plane attack surface that perimeter security was never designed for. Here is why teams adopt AegisSwarm-Core instead of bolting on ad hoc checks:

Closes the gap legacy security tools miss. Firewalls, WAFs, and IAM were built for static clients, not autonomous agents that plan, delegate, and call tools on their own; AegisSwarm governs the agent execution plane directly.
Maps to a named threat model, not a generic checklist. Every control traces to a specific entry in the OWASP Top 10 for Agentic Applications (ASI01-ASI05), so coverage gaps are visible rather than assumed.
Identity-first, not key-based. SPIFFE/SPIRE short-lived SVIDs and mutual TLS replace static API keys between agents, removing the most common path to "Confused Deputy" privilege escalation.
Policy-as-code, not hardcoded rules. OPA/Rego policies for autonomy tiers and tool access can be reviewed, versioned, and tested in CI like any other code, instead of being buried in application logic.
Quantifies risk instead of guessing. The Rs = C_impact × (1 - P_conf) scoring model gives a deterministic, auditable trigger for human-in-the-loop escalation rather than relying on the agent's own confidence claims.
Built for audit from day one. Every stage emits HMAC-signed, OpenTelemetry-traced records, so incident response and compliance reviews have a verifiable trail instead of best-effort logging.
Standards-aligned, not a one-off framework. Maps directly to the CSA Agentic Trust Framework, CSA Cloud Controls Matrix v4.1, and NIST AI RMF, so adopting it supports existing compliance programs rather than creating a new one.
Open and inspectable. Apache 2.0 licensed reference implementation in Go, with vulnerability simulation tests included, so teams can verify the guardrails actually hold before trusting them in production.

How it works

Four independent subsystems sit between an agent and the outside world. A request must clear all four before any tool executes.

1. Aegis Data Ingestion Gateway

PII/PHI tokenization and a dual-stage semantic classifier screen every input before it reaches an agent's context window, the primary defense against indirect prompt injection (OWASP ASI01).

2. Cryptographic Identity Layer

Short-lived X.509-SVID and JWT-SVID credentials via SPIFFE/SPIRE replace static API keys. Agent-to-agent calls require mutual TLS, closing off "Confused Deputy" escalation (OWASP ASI03).

3. OPA Guard Control

Every tool request is evaluated against Rego policies in Open Policy Agent before execution: autonomy tiers, globally blocked tools, and network access controls are enforced as code.

4. Escalation & Human-in-the-Loop Runtime

A dynamic risk score, Rs = C_impact × (1 - P_conf), is computed per transaction. If it exceeds the configured threshold, execution freezes until a human operator grants cryptographic clearance.

Threat coverage

Mapped to the OWASP Top 10 for Agentic Applications (December 2025).

Risk	AegisSwarm mitigation
ASI01: Agent Goal Hijack	Dual-stage injection filter + GoalVerifier semantic check
ASI02: Tool Misuse & Exploitation	OPA tier policies + globally blocked tool registry + sandbox
ASI03: Agent Identity & Privilege Abuse	SPIFFE/SPIRE mTLS + JWT-SVID peer validation
ASI04: Resource Overconsumption	Per-session token budget + rate limiting per tool
ASI05: Supply Chain Compromise	OPA policy-as-code CI gate on every manifest change

Quick start

Go 1.22+, a local SPIRE agent, and OPA are the only prerequisites.

git clone https://github.com/sunilgentyala/AegisSwarm-Core.git
cd AegisSwarm-Core
go mod download

# Run guardrail integration tests
go test ./tests/... -v

# Run vulnerability simulation tests (ASI01, ASI02, ASI03)
go test ./tests/vulnerability_simulation/... -v

# Lint and test OPA policies
opa check policies/
opa test policies/ -v

Zero-trust guardrails for autonomous multi-agent AI