Documentation

How this instance works, from the evidence model outward.

Every finding carries provenance. Severity and confidence stay separate. Authorization precedes measurement. This page documents the operating model, the roles, the surfaces, and the guarantees that hold today.

One shield, four domains

A single risk model spanning digital, physical, privacy, and compliance.

Digital posture: Passive checks on TLS, headers, DNS, cookies, CORS, and related configuration.
Physical privacy: Guided inspection with confidence capped separately from severity.
Supply chain: Bounded import of CycloneDX and SPDX documents, declared not deployed.
Compliance: Framework mapping and observed coverage counts, never a compliance percentage.

The honesty model

A finding is a measurement with its provenance attached, never a verdict.

Severity: Impact if the observation is real. Independent of confidence.
Confidence: Evidence strength. A weak signal cannot inflate severity.
Provenance: Source, method, timestamp, and coverage gap recorded per finding.
No blending: Severity and confidence stay separate. No single score hides which is which.

Authorization before measurement

The product fails closed when scope is unclear.

Deny by default: An unclear or unaffirmed scope fails closed rather than scanning anyway.
Authorization affirmation: Every scan, inspection, or import requires an explicit affirmation of legal right.
No autonomous action: Remediation is prepared for a human. Nothing is applied automatically.

Roles and boundaries

Four roles, ordered by privilege. Access is administrator-provisioned.

Owner: Full control. Can scan, inspect, manage users, and change finding status.
Scanner: Can scan and import. Cannot inspect or change status.
Remediator: Can change finding status and prepare remediation. Cannot scan or inspect.
Auditor: Read-only. Cannot scan, inspect, or change status.

The route map

Every private route requires an authenticated session.

/app: Workspace overview and readiness summary.
/scan: Digital posture scan form and results.
/inspect: Guided physical inspection flow.
/network: Network baseline checks.
/assets: Authorized asset registry and management.
/history: Assessment history and comparison.
/remediation: Remediation tracking and bulk actions.
/readiness: Self-reported module readiness matrix.
/news: Security briefings and updates.
/api-inventory: OpenAPI/Swagger document intake.
/code-inventory: Code evidence and SARIF intake.
/supply-chain: SBOM import and correlation.
/users: User management (owner only).
/report/<id>: Assessment report with findings and provenance.

Exports and artifacts

Every report can be exported in formats a human can inspect.

JSON: Structured findings with full provenance.
CSV: Tabular findings for spreadsheet review.
SARIF: Static Analysis Results Interchange Format for tool integration.
Markdown: Human-readable report for sharing and archival.

Continuous assessment

Opt-in per-asset scheduling, honest about its limits.

Per-asset cadence: Each asset can have an opt-in scan interval in hours.
While this server runs: Scheduled means while this process is alive. No external cron, no hidden state.
Drift detection: On schedule completion, changes since the last run are surfaced honestly.

Endpoint collector bundles

Offline producer artifacts are reviewable before an operator enables scheduling.

Windows: The PowerShell collector reads processes, startup items, patches, and firewall profiles without network calls or uploads.
macOS / Linux: The standard-library collector emits the same bounded five-family posture envelope from fixed read-only probes.
Bundle custody: The reproducible ZIP builder records source and member digests; unsigned output is never presented as an installed or trusted package.
Open gate: Code signing, native installation, supervised scheduling, malware/EDR coverage, and live endpoint attestation remain separate gates.

Container image posture

Offline supply-chain checks for owner-supplied OCI/Docker references.

Immutable references: Digest-linked images are distinguished from mutable tags without contacting a registry.
Registry policy: An operator-supplied registry policy highlights references outside the approved set.
Honest boundary: Aegis does not pull images, resolve manifests, query CVEs, or claim provenance from a reference alone.

Data handling

Local-first is a storage decision, not a marketing line.

Storage: Findings and evidence stay on this instance. No cloud sync.
No raw source document retention: The assessment store keeps provenance but never the raw source documents.
Durable store: Optional AES-256-GCM encrypted persistence, enabled at launch time.
Upload egress: Uploaded bytes are analysed locally and never forwarded.

Exports and artifacts

Every report can be exported in formats a human can inspect.

HTML: Full-page report with findings and provenance.
CSV: Tabular findings for spreadsheet review.
JSON: Structured findings with full provenance.
XLSX: Spreadsheet format via the canonical report builder.
SARIF: Remediation plans export to Static Analysis Results Interchange Format.
Markdown: Remediation plans export as human-readable markdown.

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.