Aegis Guardrails

At session start:

• Read aegis://summary once.
• Use canonical IDs and known_actions from the summary for all tool calls.

Before producing code, call aegis_assess when the task involves any of:

• New endpoints
• Database access/query changes
• Authentication or authorization changes
• External API integrations
• File upload or file-processing logic
• Handling classified data in the security-context.yaml
• Input validation paths (request body, URL params, query params)
• Security configuration changes (CORS, headers, cookie settings, TLS behavior)
• Secrets or credential handling
• CI/CD or release pipeline changes
• Error handling changes for externally reachable flows

When calling aegis_assess, send canonical IDs from security-context.yaml:

• boundary_crossing
• data_types[]
• services[]
• auth_scope
• input_sources[]
• action (must be selected from aegis://summary.known_actions)

After receiving results:

• Implement all returned requirements.
• Prefer returned approved patterns.
• Avoid returned anti-patterns.
• Apply returned security config, secrets, pipeline, and error-handling policies when present.
• If warnings include unknown ids, flag that the schema may need updates.

After generating security-relevant code, call aegis_review:

• Pass the requirements returned by aegis_assess.
• Pass mappings where each item contains:
• requirement_id
• satisfied_by (short explanation of the implementation)
• If pass=false or missing is non-empty, revise code before finalizing.