AegisSwarm-Core | Zero-Trust Security for Multi-Agent AI

Why AegisSwarm-Core

Multi-agent systems plan, delegate, and call tools without per-step human oversight. That creates an execution-plane attack surface that perimeter security was never designed for. Here is why teams adopt AegisSwarm-Core instead of bolting on ad hoc checks:

Closes the gap legacy security tools miss. Firewalls, WAFs, and IAM were built for static clients, not autonomous agents that plan, delegate, and call tools on their own; AegisSwarm governs the agent execution plane directly.
Maps to a named threat model, not a generic checklist. Every control traces to a specific entry in the OWASP Top 10 for Agentic Applications (ASI01-ASI05), so coverage gaps are visible rather than assumed.
Identity-first, not key-based. SPIFFE/SPIRE short-lived SVIDs and mutual TLS replace static API keys between agents, removing the most common path to "Confused Deputy" privilege escalation.
Policy-as-code, not hardcoded rules. OPA/Rego policies for autonomy tiers and tool access can be reviewed, versioned, and tested in CI like any other code, instead of being buried in application logic.
Quantifies risk instead of guessing. The Rs = C_impact × (1 - P_conf) scoring model gives a deterministic, auditable trigger for human-in-the-loop escalation rather than relying on the agent's own confidence claims.
Built for audit from day one. Every stage emits HMAC-signed, OpenTelemetry-traced records, so incident response and compliance reviews have a verifiable trail instead of best-effort logging.
Standards-aligned, not a one-off framework. Maps directly to the CSA Agentic Trust Framework, CSA Cloud Controls Matrix v4.1, and NIST AI RMF, so adopting it supports existing compliance programs rather than creating a new one.
Open and inspectable. Apache 2.0 licensed reference implementation in Go, with vulnerability simulation tests included, so teams can verify the guardrails actually hold before trusting them in production.

How it works

Four independent subsystems sit between an agent and the outside world. A request must clear all four before any tool executes.

1. Aegis Data Ingestion Gateway

PII/PHI tokenization and a dual-stage semantic classifier screen every input before it reaches an agent's context window, the primary defense against indirect prompt injection (OWASP ASI01).

2. Cryptographic Identity Layer

Short-lived X.509-SVID and JWT-SVID credentials via SPIFFE/SPIRE replace static API keys. Agent-to-agent calls require mutual TLS, closing off "Confused Deputy" escalation (OWASP ASI03).

Implemented today: real X.509 chain verification against a configured CA trust bundle, plus SPIFFE URI SAN checking read out of the verified certificate — a self-signed or wrong-CA certificate with correct-looking URI text is rejected. Documented integration point: live SPIRE Workload API connectivity for rotating SVIDs; this reference implementation loads a static PEM trust bundle instead.

3. OPA Guard Control

Every tool request is evaluated against Rego policies in Open Policy Agent before execution: autonomy tiers, globally blocked tools, and network access controls are enforced as code.

Implemented today: the sandboxed dispatcher whitelists five tools and each handler does real, verifiable work — real file reads/writes confined to a sandbox root with path-traversal rejection, and a real time-bounded go test subprocess for run_tests that is actually killed on timeout, not just abandoned.

4. Escalation & Human-in-the-Loop Runtime

A dynamic risk score, Rs = C_impact × (1 - P_conf), is computed per transaction. If it exceeds the configured threshold, execution freezes until a human operator grants cryptographic clearance.

Implemented today: a real blocking wait plus real ed25519 signature verification of the operator's approval token — no valid signed token, no unblock, and a misconfigured deployment fails closed rather than auto-approving. Documented integration point: the ITSM transport (PagerDuty/ServiceNow webhook, Slack action) that notifies the operator and carries their decision back.

Threat coverage

Mapped to the OWASP Top 10 for Agentic Applications (December 2025).

Risk	AegisSwarm mitigation
ASI01: Agent Goal Hijack	Dual-stage injection filter + GoalVerifier semantic check
ASI02: Tool Misuse & Exploitation	OPA tier policies + globally blocked tool registry + sandbox
ASI03: Agent Identity & Privilege Abuse	SPIFFE/SPIRE mTLS + JWT-SVID peer validation
ASI04: Resource Overconsumption	Per-session token budget + rate limiting per tool
ASI05: Supply Chain Compromise	OPA policy-as-code CI gate on every manifest change

Quick start

Go 1.22+ and OPA are the only hard prerequisites; a CA-signed trust bundle and an operator ed25519 keypair are needed to run the identity and escalation layers against real credentials (a live SPIRE deployment is the production source for the former).

git clone https://github.com/sunilgentyala/AegisSwarm-Core.git
cd AegisSwarm-Core
go mod download

# Run guardrail integration tests
go test ./tests/... -v

# Run vulnerability simulation tests (ASI01, ASI02, ASI03)
go test ./tests/vulnerability_simulation/... -v

# Run the sandbox, escalation, and identity adversarial tests: forged
# approval tokens, path-traversal reads, and self-signed/wrong-CA
# certificates are all exercised and must be rejected.
go test ./internal/execution/... ./internal/identity/... -v

# Lint and test OPA policies
opa check policies/
opa test policies/ -v

Media Coverage & Podcast Citations

LinkedIn — Asaf Nakash, “AI Agent Held a Database for Ransom...”: names AegisSwarm directly, both in the article text (“researcher SUNIL Gentyala, called ‘AegisSwarm,’ … sketching out how to verify and contain coordinated multi-agent systems”) and in the author's own comment (“whose AegisSwarm proposal (hosted by the Cloud Security Alliance) is one of the few serious attempts to contain coordinated multi-agent systems”).
Spotify — “Context Window: AI Security Podcast”, agentic-ransomware episode: related coverage of the same multi-agent threat landscape discussed in the LinkedIn post above; does not name AegisSwarm directly.
Agentic Threat Tracker, “Zero-Trust AI Governance for Multi-Agent Systems” (24 July 2026): incident-tracker entry on the CSA “Securing the Swarm” analysis; names AegisSwarm directly (“The piece also introduces AegisSwarm, a proposed open-source reference implementation for zero-trust multi-agent security”) and credits “Sunil Gentyala of HCLTech.”