# Why AI Agent Governance Matters

**TL;DR: AI agents are getting real-world access. Without governance, a single hallucination costs you money, data, or compliance.**

## The Scary Part

AI agents in 2025-2026 can:

- **Call APIs** — create, update, delete records in your CRM, ERP, or database
- **Run shell commands** — `rm -rf`, `kubectl delete`, `DROP TABLE`
- **Browse the web** — fill forms, click buttons, submit payments
- **Send messages** — email customers, post on social media, trigger webhooks

These are powerful capabilities. They're also **dangerous when unsupervised**.

## Real Incidents (Anonymized)

### The $50K Email Blast
A support agent AI was tasked with "re-engage inactive users." It interpreted this as sending personalized emails to **all 50,000 users in the database**, including those who had unsubscribed. The company paid $50K in CAN-SPAM fines.

**With Aegis:** A `bulk_email` action with `param_gt: { count: 100 }` would trigger human approval. The operator would see "Send 50,000 emails?" and reject it.

### The Production Database Wipe
A data pipeline agent was asked to "clean up test data." It ran `DELETE FROM users WHERE created_at < '2024-01-01'` — on the production database. 3 years of user records gone.

**With Aegis:** `DELETE` on `prod*` targets is blocked by default. The agent would need to use the staging environment.

### The 3am Deployment
A DevOps agent auto-deployed a hotfix at 3am without human review. The fix introduced a regression that took down the service for 4 hours.

**With Aegis:** Time-based conditions (`time_after: "09:00"`, `time_before: "18:00"`, `weekdays: [1,2,3,4,5]`) prevent after-hours deployments without explicit override.

## The Governance Gap

Most AI frameworks provide:

| Layer | What Exists | What's Missing |
|-------|------------|----------------|
| **Prompt level** | Input guardrails, content filters | Action-level governance |
| **Model level** | Safety training, RLHF | Runtime policy enforcement |
| **Application level** | Custom if/else checks | Centralized, auditable policy engine |

Aegis fills the application layer gap: **centralized policy, approval gates, and audit trails for every action your agent takes**.

## Defense in Depth

Aegis is one layer in a defense-in-depth strategy:

```
┌─────────────────────────────────┐
│  Prompt-level guardrails        │  ← LLM provider safety
├─────────────────────────────────┤
│  Aegis policy engine            │  ← Action-level governance
├─────────────────────────────────┤
│  Container isolation            │  ← OS-level sandboxing
├─────────────────────────────────┤
│  Network policies               │  ← Infrastructure-level control
└─────────────────────────────────┘
```

Each layer catches different failure modes. Aegis specifically catches:

- **Hallucination-driven actions** — the model "decides" to delete something
- **Scope creep** — the agent does more than it was asked to do
- **Parameter escalation** — the agent uses extreme values (count=999999)
- **Off-hours execution** — actions at times when no one is watching

## The Fix: 3 Lines of Code

```python
from aegis import Action, Policy, Runtime

runtime = Runtime(executor=your_executor, policy=Policy.from_yaml("policy.yaml"))
result = await runtime.run_one(Action("delete", "users", params={"count": 50000}))
# → BLOCKED by policy. Logged. Human notified.
```

## Next Steps

- [Quick Start](../getting-started/quickstart.md) — add governance in 5 minutes
- [Writing Policies](policies.md) — learn YAML policy syntax
- [Governance Checklist](governance-checklist.md) — audit your agent's governance posture
- [Try the Playground](../playground/) — experiment in your browser
