Three signal sources. One defensive network.

• Fifteen adversarial personas span every canonical threat type across the four Safe House checkpoints, including a supply-chain mole at inside.integrity.
• Mutation-phase gating lets attacks evolve only while per-bucket detection holds above threshold, with sustained hysteresis to prevent thrash — evaluated independently per substrate fingerprint.
• Arena traffic runs on its own isolated write path, kept separate from production signal so synthetic attacks can never contaminate customer data. The isolation is enforced server-side, not by convention.

• Customers report misses (false negatives) and over-blocks (false positives) directly from the dashboard or through the report API.
• Every report flows into the same review queue the arena feeds — one shared queue, one signed pipeline, regardless of where the signal came from.
• Calm-at-GA: this signal exists because false positives are inevitable. Mutation-phase gating and false-positive auto-rollback are both built on the assumption that we will get things wrong — and that you will tell us when we do.

• The network keeps rolling statistics for every substrate fingerprint — the provider, model, and SDK combination an agent runs on. Every evaluation across the network is stamped with that fingerprint.
• When seemingly unrelated security events at different customers share a substrate fingerprint, the aggregator ties them into a single campaign signature — the cross-tenant view no individual customer can see on their own. Live in production.
• This is what nobody else in the market has. Hyperscaler guardrails, in-process detectors, and per-tenant proxies all see one customer at a time. The aggregator sees across all of them.

AEGIS sees substrate-attributed behavioral deviation across every customer running on the same provider/model/SDK combination. One customer's evaluation stream surfacing anomalies elevates protection for every other customer on that substrate — across OpenAI, Anthropic, Gemini, or any local model fronted by the gateway.

AEGIS is the network layer. Customers running Lakera Guard, NeMo Guardrails, Cloudflare WAF, AWS Bedrock Guardrails, or Robust Intelligence can run AEGIS alongside — it complements; it does not replace. Different layer, different signal.

AAP makes the agent's intent public — transparency, not trust. AIP delivers in-flight integrity verdicts. CLPI governs the card lifecycle. AEGIS signs the cross-tenant defenses that act on the integrated picture. No layer pretends to be the one before it.