Aegis Policies

Overview

The released v0.5.5 native catalog identifies executable options for each build. Axis stores versioned drafts separately from active delivery. Every target must support the selected options in a fresh matching build report.

Check the exact catalog and runtime prerequisites. The catalog identifies separate primitive and TLS contexts; it does not configure storage or Messenger.

Exact TLS policy

This schema-v1 example requires hybrid TLS 1.3 key establishment. Cipher suites and key-exchange groups are separate fields. Certificate authentication still depends on configured identities.

{
  "schemaVersion": 1,
  "minTlsVersion": "1.3",
  "maxTlsVersion": "1.3",
  "cipherSuites": ["TLS_AES_256_GCM_SHA384"],
  "keyExchangeGroups": ["X25519MLKEM768"],
  "clientAuth": "none",
  "requirePostQuantum": true
}

A required-hybrid policy rejects classical-only peers. Requiring client authentication also needs configured trust roots on every target. New implementations require a signed release; policy edits cannot install plugin binaries.

Endpoint Assumptions

• Production auth and API host: https://axis.velikey.com (signin: https://axis.velikey.com/auth/signin).
• Non-production override: set AXIS_BASE_URL explicitly before running docs commands.
• Manual operator substitutions: provide tenant-scoped values for cookies, bearer tokens, agent IDs, and tenant slugs.

Actionable Steps

1. Save a versioned draft under /api/crypto/policy-drafts with the exact environment and target agents.
2. Preview the draft under /api/rollouts/plan, review its frozen baseline and capability checks, then explicitly apply the returned plan ID. Saving a draft leaves active delivery unchanged.
3. Verify agents can only fetch policy under matching tenant and enrollment binding.

# manual-only example
# production default; set AXIS_BASE_URL explicitly for staging/test.
export AXIS_BASE_URL="${AXIS_BASE_URL:-https://axis.velikey.com}"
export AGENT_ID="agent-001"
export AGENT_BEARER_TOKEN="REDACTED"

curl -fsS \
  -H "Authorization: Bearer $AGENT_BEARER_TOKEN" \
  "$AXIS_BASE_URL/api/agents/$AGENT_ID/policies" | jq

Validation Checks (Last Step)

# executable example
command -v curl
command -v jq
curl --version

Policy API calls should only be attempted after tenant-authenticated sign-in and endpoint reachability checks.

Common Failure Modes

• Agent token from one tenant reused against another tenant’s agent ID results in `401 Unauthorized`.
• Agent ID typo produces `404 Agent not found`.
• Policy appears missing because it is inactive or outside the target scope.

Navigate Docs

Docs Index • Previous: Aegis Install on Kubernetes • Next: Rollouts and Rollback • Troubleshooting