AAES is a client-operated governance layer for enterprise AI agents. Its boundary is the tool action routed through AAES, not the whole agent, model, or business process.
These pages describe the product. They are not a certification or a legal opinion. AAES does not certify that a client has met a regulator's requirements. The client remains the regulated entity.
Product boundary
AAES governs tool use and actions routed through it. It is not a model gateway: prompts and model completions are not on the brokered path. The daemon hashes tool-call arguments in memory; the action record stores them as a digest.
For routed actions, AAES can enforce task-scoped grants, named approval requirements, and budget ceilings. Actions classified as irreversible require approval by an authorized person. Policies can require approval for other actions too. Budget ceilings apply to spending routed through AAES, not vendor spending outside it.
Enforcement boundary
Enforcement requires control of the agent's credential path. Work that bypasses AAES is invisible to AAES. Observation is not enforcement.
If the decision journal cannot be written, AAES issues no new grant and no credential is minted. Outstanding grants remain valid for up to 15 minutes. These properties do not prevent work performed through credentials or paths outside AAES.
A valid record establishes integrity of the recorded authorization, scope, named approver, and sealed bytes. It does not prove a complete action history, the truth of recorded inputs, the absence of bypassed actions, or that a dispatched call achieved its intended outcome.
Deployment and assurance status
- Deployment
- Client-operated only, using Docker Compose or Kubernetes with Helm/Terraform, including air-gapped and on-premises deployments. There is no AAES-hosted cell today.
- Hosted offering and SOC 2
- A hosted offering is not available. Hosted mode is gated on SOC 2 Type I. No SOC 2 report exists today.
- Production status
- No production adoption is claimed.
- Adapter validation
- Native adapters are tested against local servers speaking vendor API formats, not live vendor tenants. Live tenant validation happens during a design partnership.
- Independent witnesses
- The default deployment has zero independent witnesses. Independent attestation requires a configured external witness or timestamp authority and trust material obtained separately from the export. Neither is connected by default.
- Internal checks
- Internal tests cover fail-closed behavior, named approval binding, budget ceilings, and tamper detection. These checks do not establish production validation or independent certification.
Security posture and limitations is the source for current security details. Deployment-specific questions are resolved through evaluation.
Can AAES govern this workflow?
Use these questions to scope an evaluation. An unresolved answer is a boundary to investigate, not evidence that the workflow is governed.
| Check | Question for the client |
|---|---|
| Credential control | Can you place the agent's credential path under AAES control for the actions in scope? |
| Identifiable tool actions | Can you identify the tool calls and actions to be routed through AAES, separately from prompts and model completions? |
| Named human approval owner | Can you assign each registered agent an accountable human manager and name authorized approvers in AAES? An agent cannot approve itself. |
| Client operation | Can your team operate the software in a client-controlled deployment? |
| Bypass paths | Can alternate credentials and direct tool-access paths be removed so AAES controls the credential path for the actions in scope? |
| Bypass monitoring | If a path remains outside AAES, can it be monitored separately, with that exclusion recorded? Monitoring a bypass is not enforcement. |
| Budget and approval policy | Can you agree which actions require approval and which routed spending is subject to a budget ceiling? |
| Evaluation data | Can the evaluation be conducted without production-sensitive data? |
| Client test tenant | Are you willing to validate the required adapters on your test tenant during a design partnership? |
The evaluation page states the control-evaluation scope and exit conditions. Results from a client's test tenant are produced during a scoped evaluation.
What this library is not
- Not a model gateway. AAES does not broker prompts or model completions.
- Not a hosted service. There is no AAES-hosted cell today. A hosted offering is not available.
Bring a defined workflow, its credential paths, and the approval owners to an evaluation.
Related pages: Scope: https://aaes.ai/library/scope.html · Controls: https://aaes.ai/library/controls.html · Security: https://aaes.ai/legal/security.html · Evaluation: https://aaes.ai/library/evaluation.html · Evaluation contact: https://aaes.ai/contact.html?ref=library-evaluation