摘要：Agentic AI 系统会请求执行工具操作，这些操作可能修改文件、发送消息、启动作业或改变工作流状态。这使安全问题从有害文本生成转向有害的操作性副作用。提示词层面的治理可以塑造模型行为，但无法形成执行边界。我们提出 Aegis，这是一种运行时治理系统：它将模型输出视为行动提议，并在工具执行前通过可信决策层对其进行调解。模型负责提议；可信运行时负责决策。Aegis 根据当前活动的策略状态评估提议，在服务端解析溯源信息，在存在不确定性时故障关闭，并将选定案例送入类似 Senate 的结算机制——一条基于法定人数、非单方授权的路径。我们在一个重复执行的沙盒语料库上评估了 Aegis，该语料库涵盖 5 类运行、42 项任务、3 种条件，并且每类运行重复 10 次。在共计 6,300 条记录中，提示词策略条件化产生了 79 条高风险对照路径泄漏记录。在 2,100 条由 Aegis 治理的记录中，系统记录到受治理的模拟工具调用次数为零，受治理的高风险副作用完成次数也为零。全部 1,832 条 Aegis 尝试处理的受治理记录均保留了可信的、由 Aegis 解析的溯源信息；全部 1,019 条经 Senate 结算的记录均具备法定人数和最终签名计票证据。这些结果并不能证明通用自主 Agent 的安全性。它们支持一个更狭义的系统结论：在本次评估的沙盒语料库中，运行时行动边界治理阻止了已观察到的高风险提议成为受治理的副作用。

Abstract:Agentic AI systems request tool actions that can modify files, send messages, launch jobs, or change workflow state. This shifts the safety problem from harmful text generation to harmful operational side effects. Prompt-level governance can shape model behavior, but it does not create an execution boundary. We introduce Aegis, a runtime governance system that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. The model proposes; the trusted runtime decides. Aegis evaluates proposals against active policy state, resolves provenance server-side, fails closed under uncertainty, and routes selected cases through Senate-style settlement, a quorum- based non-unilateral authorization path. We evaluate Aegis on a repeated sandbox corpus spanning five run families, 42 tasks, three conditions, and ten repeats per family. Across 6,300 rows, prompt-policy conditioning produced 79 risky comparator-path leakage rows. Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions. All 1,832 Aegis-attempted governed rows preserved trusted Aegis-resolved provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. These results do not prove general autonomous-agent safety. They support the narrower systems claim that, in this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from becoming governed side effects.