Aegis
Zero-trust authorization runtime for AI retrieval systems.
Closes the gap between deterministic access control and probabilistic vector search — re-verifies every retrieved chunk against policy at query time.
Overview
Enterprise RAG has a structural security gap: vector databases return results by semantic similarity with no notion of who is allowed to see them, while enterprise authorization (RBAC, ABAC, ReBAC) is deterministic and policy-based. Aegis closes that gap by treating authorization as a first-class retrieval constraint, re-verifying every retrieved chunk against policy at query time. It supports relationship-based access control with transitive closure computation, agent delegation with explicit scope boundaries so an agent can never inherit a user's full clearance, and break-glass emergency access that requires mandatory post-hoc review.
Key figures
17.89ms
P95 authorization latency (down from 246.76ms pre-optimization)
6.1x
faster relationship-based access checks vs. naive graph traversal
20/20
adversarial security tests passing
How it works
Verify identity
Every request is authenticated with JWT/OIDC through Keycloak before retrieval begins.
Evaluate policy
The caller's access is evaluated against policy written in OPA/Rego.
Filter at the source
Policy is compiled directly into the Qdrant vector database query filter, so unauthorized candidates never enter the results in the first place.
Re-verify independently
Every retrieved chunk is checked again through a separate, structurally distinct code path, not the same filter applied twice.
Firewall the context
A context firewall validates provenance and detects contamination from mixed authorization scopes.
Audit every layer
Every transition between layers emits a structured, queryable audit event.
Key features
8-layer defense pipeline
OPA/Rego policy compilation
Independent per-chunk re-verification
Relationship-based access control (ReBAC)
Admin console for policy review
Interested in Aegis?
Tell us about your needs and we will get back to you within one business day.
Request a Pilot