Forrester’s AEGIS, Agentic AI Enterprise Guardrails For Information Security, organizes the security of agentic AI into six domains: governance, risk and compliance; identity and access management; data security and privacy; application security and DevSecOps; threat management and security operations; and Zero Trust architecture. Its theme is securing intent, not just actions. For each domain, applied to AI agents acting on an employee’s device: the question a CISO should ask, what MoorAI measures today and the gap.
Mapped by domain from Forrester’s public description of AEGIS; not a Forrester assessment or endorsement. The full framework is a Forrester client report; nothing here describes its contents. The ids (AEGIS-GRC to AEGIS-ZT) are MoorAI’s own, one per domain, not AEGIS control ids.
Six domains, on the device
AEGIS-GRC · Governance, risk and complianceimplemented
Ask. Which policy were the agents under during the audit window, who changed it, and can an auditor check that without access to your console?
Measured today. Policies signed with your tenant’s ed25519 key, which the device verifies before it enforces them; console changes in a hash-chained governance log; the runtime AIBOM of which agent used which model, MCP server and tool; and an AEGIS evidence pack from the console, sealed with a signed SHA-256 manifest an auditor checks offline.
Limit. The alerts and heartbeats inside the pack reach the console with the tenant install token; they are not device-signed.
AEGIS-IAM · Identity and access managementpartial
Ask. Who owns each agent, what can it reach, does it use only what it needs, and who approves a high-impact action?
Measured today. Agent ownership: owner, purpose and approval state per agent, MCP server and AI key, with ownerless and stale findings. Granted-vs-used right-sizing over 30 or 90 days, the MCP server approval gate and device-key binding. Business actions, such as a refund, a bulk export or a role grant, that a signed policy sets to ask or block.
Gap. There is no just-in-time routing of an approval to a human approver, and no credential lifecycle for agent identities.
AEGIS-DATA · Data security and privacypartial
Ask. What stops a secret or personal data leaving through an agent, and what does the security tool itself send off the device?
Measured today. On-device DLP on prompts, tool-call arguments and model requests, with masking. Alerts carry a category, a risk, a decision and a keyed hash, never the matched text.
Gap. There is no purpose-bounded data access. MoorAI decides whether data may leave in a given call, not which data an agent may use for which purpose.
AEGIS-APPSEC · Application security and DevSecOpsimplemented
Ask. How are model calls and MCP tools protected against injection and tampering, including a tool that changes after it was approved?
Measured today. The model proxy; the MCP gateway and guard, which block a tool whose description or schema drifted since approval and list the server’s tools afresh before judging a call against a stale listing; prompt-injection detection; and the SDK and sidecar for AI apps you build.
Limit. A call on a path no MoorAI hook, proxy or gateway sits on is not checked.
AEGIS-THREAT · Threat management and security operationsimplemented
Ask. Do agent detections reach the SOC in the terms it already uses, and can you trace an incident back to what the agent read?
Measured today. Alerts streamed to the SIEM, mapped to MITRE ATT&CK v20 and MITRE ATLAS; the living-off-the-AI detectors; context.tree, a per-session Merkle tree of what entered the agent’s context; and a patient-zero lookup that finds every session that took in a given file.
Limit. context.tree is tamper-evident, not tamper-proof: its leaves and roots are not device-signed.
AEGIS-ZT · Zero Trust architecturepartial
Ask. Is every agent action checked before it runs, and what happens when the check cannot decide?
Measured today. A check before every agent action; egress rules by binary, host, method and path; Windows MXC containment set by policy; and a fail mode, open or closed, that the administrator chooses per surface.
Gap. Outside MXC, the agent runs as the same user as the developer. There, MoorAI is governance, not a sandbox.
Intent: Forrester’s theme
Forrester’s framework page heads one section “Securing Intent, Not Just Actions”: checking that an action is allowed is no longer enough when an agent chooses its own actions. On the device, MoorAI checks each risky action against the task the user stated.
When a user submits a prompt, the hook keeps keyed, device-local hashes of the sites, paths, service names and labels it mentions, never the prompt itself. An upload, a destructive command, a credential read or an MCP write aimed at something the user never mentioned raises rule #64, Action outside the stated task. It is report-only by default, and a policy can raise it to ask. With model escalation on, a model on the device also labels the prompt, as a second opinion.
The matching is by names and labels. It catches an agent going somewhere the user never pointed it, not a wrong reason for going somewhere the user named. Text pasted into a prompt widens the task.
Questions to ask any vendor
- Which AEGIS domains do you produce evidence for, and which do you leave to other tools? Ask for the gaps in writing.
- Where does the check run? On the device before the action, or in a cloud service after it?
- What leaves the device? Prompts and file content, or only a verdict and metadata?
- How do you compare an action with the user’s intent, and what does that comparison miss?
- When an MCP tool’s description changes after approval, is the call blocked or only reported?
- Who chooses fail open or fail closed, and can the agent change it?
- What can an auditor verify without access to your console?
Limits
Domain level only
The mapping is by domain, from Forrester’s public pages. It uses no AEGIS control ids and is not a Forrester assessment.
Token-authenticated evidence
Alerts, heartbeats and allow-trail records reach the console with the tenant install token, which an agent on the device can read. They record what the console was told, not what a device key signed.
Lexical intent
Rule #64 matches names and labels, not meaning, and judges only actions that are already risky. The agent runs as the same user and can tamper with the device-local state the check keeps.
Sources
- Forrester. AEGIS framework, forrester.com; Introducing AEGIS: The Guardrails That CISOs Need For The Agentic Enterprise, Forrester blog, 4 August 2025. Domain names here follow the framework page; the blog uses shorter ones.
- MoorAI. The compliance crosswalk’s AEGIS section, with the console ids per domain; MoorAI on GitHub, README sections on intent alignment (#64) and business actions.
See also: the compliance crosswalk, MoorAI for AI coding agents and MCP security.