Skip to Content

AEP Enterprise Governance, Approvals & Audit Trail

The isA AEP Portal (isagent.io/aep) establishes the enterprise security boundary for autonomous agent swarms and Model Context Protocol (MCP) integrations. It guarantees that high-impact system mutations, credential access, and runtime deployments are governed by strict sandbox policies, dual-signoff human approvals, and cryptographic audit trails.

Enterprise Governance (1m 32s)

AEP Deep Dive: Dual-Signoff Approvals, Sandbox Policies & Immutable Audit

Launch AEP Governance Portal
Jump to Key Action
Real-world engineering walkthrough inside the isA AEP Governance Portal: inspecting active operations and pending requests, triaging human-in-the-loop task approval cards with policy evaluation and dual sign-off controls, auditing agent governance and runtime authority containment rules, exploring pre-approved DevEx Packs and application templates, and inspecting the SHA-256 cryptographically attributed audit log.

1. Architectural Highlights Demonstrated

1.1 Human-in-the-Loop Dual-Signoff Task Approvals

Autonomous agents cannot perform irreversible mutations without explicit clearance:

  • Risk Classification Matrix: Actions involving production database writes, payment or budget adjustments, and external cloud infrastructure mutations are flagged as L3 High-Impact.
  • Interactive Approval Cards: Detail the exact SQL queries or API payloads, originating prompt, requesting agent ID, and automated policy compliance score.
  • Dual-Signoff Requirement: High-risk tasks mandate two distinct role signoffs (e.g., Lead Software Engineer + SecOps Auditor) before execution clearance.

1.2 Two-Tier Sandbox & Runtime Authority

AEP enforces containment across local developer tools and cloud orchestrators:

  • Tier 1 (Execution Sandbox): Protects developer worktrees by isolating process execution, blocking path traversal, and enforcing zero-egress policies.
  • Tier 2 (Cloud Authority Gates): Validates incoming MCP tool calls against tenant-scoped JSON Schemas and cryptographic HMAC tokens issued by auth_service.

1.3 Cryptographic Audit Trail & Evidence Export

Every system event is recorded to an append-only ledger:

  • SHA-256 Attribution: Each audit log entry binds request_id, decision_id, invocation_id, and payload hash.
  • Tamper Evidence: Cryptographic chaining guarantees that log entries cannot be modified or re-ordered post-execution.
  • Compliance Export: One-click export to SOC 2 and ISO 27001 compliant JSON/CSV audit reports.