Honest scope. What aiegis captures, what it does not, and where each gap is on the roadmap. Compliance teams can plan defense-in-depth knowing exactly where the boundary is.
aiegis sensors capture TLS connection metadata via OS-level hooks (Schannel on Windows, NetworkExtension on macOS). The capture surface depends on what the OS exposes at the TLS handshake layer.
Modern browsers (Firefox stable, Chrome experimental flags, Safari 17+) increasingly support ECH, which encrypts the SNI extension in the TLS ClientHello. When a user runs an ECH-enabled browser to an ECH-supporting server, our network sensor sees the connection IP and timing but not the destination hostname. Vendor matching by SNI fails for that connection.
What still works: the aiegis browser extension captures prompts at the DOM layer before TLS encryption happens. For ECH coverage today, deploy the extension alongside the network sensor (belt-and-braces).
What does NOT work: network-sensor-only deployments on machines where users run ECH-enabled browsers without the extension installed.
Users running their AI traffic through a VPN, SSH local-forward, or non-corporate proxy will surface in capture events with a tunnel_active or proxy_active flag. The sensor records that the bypass exists but cannot read the destination SNI behind a tunnel terminator under the user's control.
Defense pattern: the flag itself IS the audit signal. Auditors and compliance officers see "this endpoint had unverified tunnel traffic during the audit window" and can require remediation.
aiegis sensors run as a privileged service (LocalSystem on Windows, root LaunchDaemon on macOS). An attacker who has already achieved kernel-level code execution can stop the service or feed it false events. We document this as out of scope for v0.5.
What still works: a SYSTEM-level service is harder to disable than a user-level process. The watchdog detects soft-disable scenarios (process running but not capturing) and flags them in the audit log. Stale-detect alerts surface in the customer dashboard within 30 minutes.
When EYE blocks a prompt, it stores that prompt in full on the customer's own infrastructure, so an auditor can see exactly what was stopped — the exact text, the vendor, the time, and the process. It never reaches AIEGIS and never leaves the customer's systems.
Prompts that pass policy aren't stored — so EYE can't retroactively show a prompt that was never blocked. That's the honest limit: a full audit trail for what's blocked, and nothing kept for what isn't.
The sensor runs offline-first: capture continues with no network access. License-validation grace period is 30 days. Audit-pack manifests sign locally and queue for upload when connectivity returns. For truly air-gapped deployments (defense, industrial control), see the sovereign-tier deployment which ships with on-premises license + audit infrastructure.
Compliance teams plan defense-in-depth. Knowing where aiegis stops lets them deploy the right complementary controls (DLP, CASB, network segmentation) at the boundary. A vendor who claims complete coverage is either wrong or hiding the gap. We would rather lose a deal to a more honest pitch than win one we cannot defend in an audit.
Found a limitation we have not documented? Email [email protected] or open an issue on our public Grid repo. Empirical falsification is the fastest way to make this list better.