aegress
Sign in

Govern AI access
before it spreads

Route work email to company SSO for governed access to AI. Or create setup/recovery access when you need it.

BrowserMCPEntraEvidence
Aegress

Browser prompts, MCP tools, and app grants resolve into one evidence chain.

Browser extension

Govern AI in the browser

MCP gateway

Control tool and model access

Entra app scan

Discover and assess enterprise apps

Sign inCreate setup/recovery owner

You're in control. Aegress doesn't access your data.

Governs every AI surface your team already uses

AI surfaces

ChatGPT
Gemini
Claude
Perplexity
Copilot
Mistral

Enterprise apps

Microsoft 365
Salesforce
nowServiceNow
wdWorkday
Okta
Google Workspace

Why Aegress

Adopt AI fast, without losing the thread

Control and evidence that keep up with how quickly your team picks up new tools.

See every AI surface

Discover shadow AI across browsers, MCP clients, and Entra app grants in a single view.

Govern without slowing teams

Identity-first routing keeps people moving while policy runs quietly in the background.

Prove it on demand

Every access decision lands in an append-only audit chain you can export for review.

Trace intelligence

One decision graph, three evidence sources

Aegress

Browser

Prompts and extension policy

MCP

Tool call scope and client

Entra

App grants and ownership

Identity

SSO, SCIM, owner access

Policy

Allow, warn, block, monitor

Evidence

Hash-linked audit trail

Coverage modes

Follow access from browser to proof

Extension, MCP gateway, and Entra app scan stay separate in setup, then converge into one audit chain.

Browser extensionManaged browser AI policy and audit for deployed extension fleets.MCP gatewayTool and model access policy for MCP clients and agent workflows.Entra app scanMicrosoft 365 consent and app grant discovery from Entra.

Traceback canvas

Three sources, one evidence path

append-only

Browser extension

  1. 1Prompt opened
  2. 2Policy matched
  3. 3Warning logged

MCP gateway

  1. 1Tool request
  2. 2Scope checked
  3. 3Action allowed

Entra app scan

  1. 1Grant imported
  2. 2Risk scored
  3. 3Owner assigned

Policy decision

The same user, tool, policy, and tenant context follow the trace.

Evidence chain

Verifiable records are ready for audit, export, and replay.

Entry logic

Identity first, mode second

We route work email traffic to company SSO once a domain is verified, keep a setup/recovery owner for bootstrap and recovery, and choose coverage mode only after identity is established.

Entry logic

  1. 1

    Work email routes to company SSO when a domain is verified.

  2. 2

    Setup/recovery owner access stays for bootstrap and recovery.

  3. 3

    Coverage mode is chosen after identity: extension, gateway, or scan.

Access trace
Policy decision
Immutable log
Audit chain

Evidence

Every AI access decision, proven

Governed access produces an immutable record you can hand to a compliance review — no scrambling for screenshots.

  • Every access decision is recorded with the policy that produced it.
  • Logs are append-only and verifiable with a per-record hash.
  • Export an audit pack scoped to a tool, user, or time window.

Evidence chain

Immutable audit trail for AI access and activity

All verified
1

SSO connection

Microsoft 365
policy: domain verifiedhash 8c1a...7f42
09:14:22Verified
2

AI access allowed

ChatGPT
policy: browser policyhash 29bf...ab10
09:15:03Verified
3

MCP tool call

Jira MCP
policy: tool scopehash 73d0...91ec
09:16:18Verified
4

Grant scan

Entra ID
policy: app ownerhash bd44...31aa
09:16:41Verified
Logs are append-only and cryptographically verifiable.

SSO-native

Verified domains route to your IdP.

No data access

Aegress never reads your content.

Append-only evidence

Tamper-evident, hash-verified logs.

Minutes to deploy

Extension rollout in three steps.

FAQ

Answers before you ask

The questions security and IT teams raise first.

Does Aegress read our prompts or data?+

No. Aegress governs access and records the metadata needed for evidence. It never reads your prompts, files, or content.

How fast can we deploy?+

Verify a domain to route work email through SSO, or create a setup/recovery owner first. Extension rollout is connect, assign, verify.

What does it cover?+

Browser AI extensions, MCP clients and agent tools, and Microsoft 365 and Entra app grants — governed from one place.

How is access proven?+

Every decision is written to an append-only, hash-verifiable audit chain you can export by tool, user, or time window.

Govern AI access before it spreads.

Route a verified domain to SSO, or create setup/recovery access in minutes.

Get startedSign in

You’re in control. Aegress doesn’t access your data.