The Deep Path for Consequential Actions
The PDP fast path decides in-line, per call. When an action warrants a full forensic pass, the security gateway runs a LangGraph investigation, enriches the request, and returns a complete decision record.
Illustrative product view
Fast path and heavy path
Most actions should be decided in-line and cheaply - that is the stateless PDP fast path. But some actions warrant a deeper look. The security gateway (POST /api/v1/aegis/security-gateway) is the heavy path: a LangGraph investigation graph runs enrichment, then the PDP, then composes the response, returning a full ActionDecisionRecord. Same verdict model, more context behind it.
| Aspect | PDP fast path | Security gateway |
|---|---|---|
| Endpoint | /aegis/pdp/decide | /aegis/security-gateway |
| Cost | Cheap, stateless | Heavier, investigative |
| Enrichment | Minimal | LangGraph investigation graph |
| Output | Verdict + score + hash | Full ActionDecisionRecord |
| When to use | Every action | Consequential / ambiguous actions |
The investigation graph
How the heavy path runs
- 1
Investigate
A LangGraph investigation graph gathers additional context around the action.
- 2
Enrich
The gathered signals enrich the risk beyond what the fast path sees.
- 3
Decide
The PDP runs on the enriched request, applying the same deterministic rules.
- 4
Compose
The response is assembled into a full ActionDecisionRecord.
- 5
Record
The decision is written to the tamper-evident trust ledger.
Same decision model, more depth
- The gateway runs the same PDP, so verdicts use one consistent vocabulary
- Enrichment adds context; it does not change the rule order
- The output is a richer record for consequential decisions
- Enforcement is still simulate by default - the gateway decides and records
How it connects
The security gateway wraps the same PDP the fast path uses, so both share the Action Trust Score and verdict model. Its richer ActionDecisionRecord feeds Decision Intelligence and, for cross-domain decisions, Trust CORTEX - and every gateway decision is recorded to the trust ledger like any other.
Frequently asked questions
What is the security gateway?
The security gateway is AegisAI’s heavy decision path. Where the PDP fast path decides cheaply in-line, the gateway (POST /api/v1/aegis/security-gateway) runs a LangGraph investigation graph to enrich the request, then runs the PDP, and returns a full ActionDecisionRecord - the same verdict model with more context behind it.
When should I use the gateway instead of the PDP fast path?
Use the fast path for every action - it is stateless and cheap. Reserve the security gateway for consequential or ambiguous actions that warrant a full investigative pass, where the extra enrichment and the detailed ActionDecisionRecord are worth the heavier cost.
Does the gateway use the same rules as the PDP?
Yes. The gateway runs the same PDP with the same deterministic rule order - tenant isolation, scope containment, sensitivity ladder. The investigation graph adds context that enriches the risk, but it does not change how the verdict is decided, so both paths speak one consistent decision vocabulary.
Does the security gateway enforce actions?
No. Like the rest of Aegis, it runs in simulation mode by default: it decides, enriches, and records, but does not actuate. The containment or revocation in an ActionDecisionRecord is simulated, so the gateway is a deeper decision fabric your own systems enforce, not an actuator.
Stay in the loop
One practical finance briefing a week - new guides, checklists, and benchmarks.
Go deep on the decisions that matter
Run the investigation graph and get a full decision record for consequential actions.
Talk to us