aegis ops
pillars
-
tasking
Mission task graph with visible state and priority
Guided handoffs and reviewer WHY field
Linked entities: unit, asset, location, threat, case
-
sla
Live chips: OK • WARN • BREACH with mm:ss timers
Defaults: WARN 2h, BREACH 6h. Per-mission overrides
Auto actions: escalate, reassign, open incident, notify
-
policy
Inference-time enforcement on every task and handoff
Outcomes: PASS • INTERCEPT • BLOCK • REDACT
Suppression memory, override requests with quorum and reason
-
proof
Cryptographically signed Proof Packs for every consequential action
Contents: inputs, route, decision, evidence, approvers, signature
Soft delete with confirm delay, forced reason, auto-rollback
-

command views
Split Ops and Common Operational Picture
Filters by mission, SLA state, policy hit, asset, location
Heatmaps for WARN and BREACH concentration
-

Interop
Sentinel feeds tasks. Relay returns outcomes as feedback
Webhooks and event bus for SIEM, ticketing, comms
Endpoints: /tasks /slas /rules /cases /proofpacks /events
-

Security
Encryption at rest, tamper-evident logs, signer identity
Air-gap mode with queue and later reconciliation
-

KPIs
Time to acknowledge. Time to close
Override rate. Policy hit rate
Proof completeness. SLA breach count

