01
Instruction/data boundary
Instructions come only from you. Everything the agent reads — files, web pages, tickets — is untrusted data and is never executed, no matter what it says. Injection attempts are flagged and quoted back.
CIARUSTCODE · by Consultancy in Action
The coding agent that can't reach around its own guardrails.
AEGIS runs the AI inside a mandatory safety kernel. Every file edit, command and network call is classified, consented, sandboxed — and written to a tamper-evident ledger you can verify later. Local-first at $0, or bring your own key to any provider.
Get early access →
Free for noncommercial use — personal, research, education, nonprofits. Commercial use is by licence from CIA.
Our guardrailed, provider-agnostic agentic coding tool, at a glance
Approach
Safety as architecture
The agent runs inside a Rust safety kernel it structurally cannot bypass — not a prompt, not a plugin.
Cost
$0 to run locally
Any local Ollama model at zero token cost, or bring your own key to any cloud provider at raw rates. Free for noncommercial use; commercial use needs a licence.
Proof
A tamper-evident ledger
Every action is hash-chained and signed, so you can verify exactly what ran — even offline.
Why AEGIS exists
A coding agent is the most dangerous AI you'll ever run.
It edits files, runs commands, reads secrets, calls the network and installs dependencies — on the machine where your real work lives. Every leading tool treats that risk as a UX problem: a confirmation prompt bolted onto an agent that otherwise has the full reach of your user account.
We wanted the opposite for our own client work: an agent we could point at a real repository and still prove, afterwards, exactly what it did — with destructive actions, secret exfiltration and prompt injection structurally prevented, not politely discouraged.
The model may be wrong, manipulated, or adversarially steered — and the human must remain in control regardless.
So the guardrails aren't a prompt. They're a Rust safety kernel the agent physically cannot bypass: the agent core holds no syscall capability of its own — it can only submit typed intents to the broker.
How it works
The agent lives inside concentric rings. Every arrow crossing a ring is typed, checked and logged.
Host system
filesystem · network · processes · secrets
Aegis Layer — safety kernel
intent ↓ result ↑policy engine · sandbox broker · consent gateway · secrets firewall · audit ledger · kill switch
Agent core
reasoning loop · edit engine · provider abstraction — emits intents only
LLM
local Ollama or cloud BYOK — no direct I/O, ever
-
1
The model proposes. It can't touch anything — it emits a typed intent:
read,apply_diff,run,net_fetch… -
2
Policy classifies. Each intent lands in a tier: Auto Confirm Forbidden — from a YAML policy file you version-control.
-
3
You consent, per action. Confirm-tier intents pause with the exact diff or command. One approval never generalises.
-
4
The sandbox executes. Commands run under an OS sandbox — writes confined to the project, network denied by default, outbound payloads scanned for secrets.
-
5
The ledger remembers. Every event is appended to a hash-chained, signed ledger. Verify it any time →
Watch it work
A real session, un-staged: find the bug, ask permission, fix it, prove it.
Recorded against a local Ollama model — total model cost $0.00. The agent reads the code
(Auto tier), proposes a diff (Confirm tier — the kernel pauses for a keypress), runs the tests
inside the sandbox, then ciarustcode verify checks the session's hash chain.
The ten principles
Enforced in the architecture — not promised in a system prompt.
Each principle maps to a named module in the kernel, and each is exercised by the kernel test suite — 140 tests on the safety layer alone.
02
Least privilege & scope
The agent starts with zero capabilities. Reads and writes are bounded to the project directory; your home folder, system directories and credential stores are structurally out of reach.
03
Tiered consent
Every action is classified Auto, Confirm, or Forbidden before it runs. Consent is per-action and per-session — one approval never generalises.
04
Defence-in-depth sandboxing
Commands run inside an OS sandbox (macOS Seatbelt): writes confined to the project tree, network denied by default.
05
Corrigibility & kill switch
One keystroke halts everything. A dead-man's checkpoint forces re-authorisation past a step or spend threshold. The agent cannot disable the layer.
06
Secrets firewall
Secrets live in a vault the agent core cannot read. Every outbound payload is scanned; a leaked key is blocked before it leaves the machine.
07
Content & misuse policy
Refuses to knowingly produce malware, exploits, or credential harvesters — as auditable rules in the policy engine, not a black box.
08
Tamper-evident audit ledger
Every intent, decision, consent, diff, command and network call is appended to a hash-chained, Ed25519-signed ledger. Tampering breaks the chain and is detectable.
09
Cost & autonomy governance
Hard per-session and per-day spend caps, max steps, max files, max wall-clock — enforced by the broker, with a live cost meter in the UI.
10
Supply-chain integrity
Dependency installs require pinned versions and explicit confirmation; post-install scripts run sandboxed under the same egress rules.
Receipts, not vibes
Built like the security tool it is.
394
tests, 0 clippy warnings
140 dedicated to the safety layer alone
16/16
red-team bypasses fixed
31 candidates surfaced, 16 confirmed real, all fixed with regression tests
$0
to run fully local
any Ollama model; BYOK cloud keys at raw provider rates, no markup
~45k
lines of Rust, 8 crates
one auditable workspace, one binary
Red-teamed against its own threat model
We attacked it the way an adversary would — shell-wrapped commands, egress host-confusion, ledger tampering, injection-laced files, autonomy runaway. 31 candidate bypasses surfaced; 16 were confirmed real; all 16 were fixed with regression tests pinning them shut.
Then we published the receipts. See how you verify a session yourself →
New — July 2026
Memory, skills, sessions and subagents — each one attested in the same ledger.
Other agent harnesses added memory and swarms by giving the model more ambient power. AEGIS added them the only way it knows how: through the kernel. Each capability below is a ledger event you can verify after the fact — the convenient thing and the audited thing are the same thing.
Semantic memory recall
memory_recalled
Approved facts are embedded on-box (local nomic-embed-text — nothing leaves the machine) and each message pulls in only the relevant ones. Every recall is a ledger event: which facts, what similarity, triggered by what. "What did the model remember, and why" is now a query, not a mystery.
Skills that find you
skill_injected
Your slash-command skills auto-inject when a message semantically matches one — no need to remember the name. Because the trigger is implicit, the body is injection-scanned before it rides in, secret-redacted, byte-capped, and attested. An explicit /name still works untouched.
Named, resumable sessions
run --name · --resume · sessions
Name a session and the conversation persists after every turn; resume it tomorrow — interactively or headless, so a CI job can pick up where a human left off. Same file, same rules, same ledger. Session names are validated identifiers that can't escape their directory.
Read-only explorer subagents
explorer_spawned
The agent can delegate an investigation to a subagent with a fresh context and get back a file:line-cited report. Containment is structural: the explorer's toolset holds only read tools — it can't edit, run, fetch, or spawn — and it shares one broker, one budget, one ledger with the session that spawned it.
Measured, not claimed
The safety kernel costs you milliseconds, not minutes.
Measured on the release build, Apple-silicon M3, 2026-07-23 — a kernel around every action doesn't have to feel heavy.
4.6 ms
cold start (median of 10)
first-ever launch ~0.5 s while macOS caches the 17 MB binary; every start after: milliseconds
7.3 MB
peak memory at launch
measured with /usr/bin/time -l — the whole kernel, not a stripped stub
20/20
parallel cold starts
twenty concurrent launches, all clean, 23 ms total wall clock
~25 ms
added per message by semantic recall
local nomic-embed-text on-box; a 200-fact memory embeds once in ~1.1 s and re-ranks in under a millisecond
5/5
live sessions under stress
five consecutive real model runs; the ledger verified after — hash chain intact, 31/31 signatures valid
17 MB
single static-ish binary
the CLI/TUI, kernel included — no runtime, no daemon required
It gets better as you use it
A learning loop with a paper trail.
AEGIS can review its own sessions and propose skills and memories — but writing them is a kernel-gated intent like any other. You approve or reject every proposal, a weekly curator consolidates the library, and the journal records the lot.
How it compares
The two axes nobody else occupies.
Local-first with no API key required, and a safety layer that is mandatory and architectural rather than optional and bolted-on.
| AEGIS / CIARUSTCODE | The field, typically | |
|---|---|---|
| Safety layer | Mandatory kernel: typed intents, OS sandbox, egress + secrets firewall, hash-chained ledger, kill switch | Permission prompts bolted onto an agent with full user privilege; no audit trail |
| Local / offline | Local-first by default — any Ollama model, $0 per token, air-gap mode with signed proof | Cloud-first; local models unsupported or second-class |
| Cost | Free for noncommercial use; commercial licence required. $0 to run locally, or BYOK at raw provider rates — no platform markup, no bill shock | $10–$200/month plans, metered credits on top |
| Prove what ran | verify / replay / usage / attest — a cryptographic record you can hand to a client or auditor | Chat scrollback, if you saved it |
| Provider lock-in | Anthropic, OpenAI, OpenRouter, Groq, Google, or any OpenAI-compatible endpoint — switch per call | One vendor's models, one vendor's pricing |
| Memory & subagents | Semantic memory recall, auto-injected skills, named resumable sessions, read-only explorer subagents — every one a signed ledger event | Ambient memory and agent swarms you can't audit after the fact |
Field = the leading agentic coding tools as of mid-2026 (Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Replit Agent, OpenCode). Each is excellent at what it optimises for — none ships a mandatory, architecturally-enforced guardrail layer. That is the whole point of AEGIS.
The honest trust model
What actually contains the agent — and what's just a tripwire.
We assume the model may be wrong, manipulated, or adversarially steered — and design so you stay in control regardless. The honest split: the sandbox, scope, egress firewall and ledger contain the agent; the scanners are tripwires that catch things early. Security claims you can audit, not vibes.
Structural containment
- The OS sandbox (Seatbelt) around every command
- Deny-by-default network egress with an explicit allow-list
- Filesystem scope — writes bounded to the project tree
- The hash-chained, Ed25519-signed audit ledger, checked at runtime
- The kill switch and dead-man's checkpoint in the broker
Best-effort tripwires
- The prompt-injection scanner (pattern-based, best-effort)
- Regex intent classifiers (red-teamed, but not a proof)
- The model's own judgement (assumed wrong or manipulated by design)
Any tool that tells you its injection scanner is bulletproof is selling you something. Ours is a tripwire in front of a wall — the wall is the sandbox, the scope and the egress firewall.
Trust profiles
Pick a posture, preview it, then run.
One named profile picks a preset posture. Profiles are transparent overlays on your policy file — applied after parsing, so a contradictory field can't quietly weaken one — and the kernel's structural forbiddens stay non-negotiable under every profile. One command previews the complete effective policy before anything runs.
ciarustcode profile personal
Guarded local-first defaults — your explicit policy fields preserved.
ciarustcode profile client-work
Deny-by-default egress, secret scanning, signed audit, checkpoints at least every 10 effectful actions.
ciarustcode profile regulated
Client-work controls plus hard step, file and checkpoint caps — and automatic learning disabled.
ciarustcode profile air-gapped
Egress denied outright, air-gap enforcement on, loopback-only — signing and secret scanning retained.
ciarustcode profile custom
No preset overlay — your explicit policy file remains authoritative.
$ ciarustcode profile client-work
# prints the complete effective policy — zero-effect, nothing runs
Not shipped, not claimed: organisation identity, signed team-policy releases, named owners, expiring exceptions, remote administration. Profiles are a single-operator tool today.
Questions
The short answers.
What is AEGIS (CIARUSTCODE)?
A guardrailed, provider-agnostic agentic coding tool built in Rust. The agent runs inside a mandatory safety kernel — the Aegis Layer — which classifies, consents, sandboxes and logs every action. There is no path from the model to your machine that bypasses it.
Does it work offline or with local models?
Yes — AEGIS is local-first. It runs any Ollama model at $0 per token, fully private, and has an air-gap mode that refuses all network egress and records signed proof that nothing left the machine. Cloud models work too, via your own API keys at raw provider rates.
How is it different from Claude Code, Codex or Cursor?
Those tools bolt safety on as permission prompts around an agent that otherwise runs with your full user privilege. In AEGIS the safety layer is the architecture: the agent core has no syscall capability at all — it can only submit typed intents to a broker that enforces policy, sandboxing, a secrets firewall and a tamper-evident audit ledger.
Can I prove what the agent did?
Yes. Every intent, decision, diff, command and network call is written to an append-only, hash-chained, Ed25519-signed ledger. ciarustcode verify checks the chain, replay prints the full transcript, usage summarises cost and egress, and attest exports a portable signed proof bundle you can verify offline.
Does it have memory, skills, or multi-agent support?
Yes — added July 2026, and each one is audited. Approved memories are recalled semantically per message (embedded locally, nothing leaves the box), skills auto-inject when a message matches one (scanned and capped first), sessions can be named and resumed by name — even from CI — and the agent can delegate to read-only explorer subagents that share one broker, one budget and one ledger. Every recall, injection and subagent span is a signed ledger event you can verify afterwards.
What does it cost, and can I use it at work?
Two separate things, stated plainly. Running it: $0 — any local Ollama model at zero token cost, or your own cloud key at raw provider rates with no markup. Licensing it: AEGIS is source-available and free for noncommercial use — personal projects, research, education, hobby, nonprofits and government — under the PolyForm Noncommercial 1.0.0 licence. Any commercial or client-delivery use needs a commercial licence from Consultancy in Action. Nothing hidden: if you're a for-profit shipping work with it, talk to us.
Private preview
Run agents you can prove things about.
AEGIS is in private preview while we harden it on our own client work. Leave an email and we'll send one message when early access opens — or talk to Consultancy in Action about a guarded-agent engagement now.