Challenge, response, delegation, key.
Aegis is the authentication and authorization framework built on OAS. It provides challenge-response authentication that proves possession of an OAS key without revealing it, a key management subsystem (HKDF for lineage, FROST for threshold signatures, BIP-44 for multi-chain wallets), and a delegation tree mechanism enforcing the no-amplification rule — no delegate may carry more authority than its delegator. Multi-dimensional policies bound spending, time, and lineage simultaneously.
Every method is dispatched through MAP. Capability scope, policy, and accounting apply uniformly.
A canonical call. Identity, capability, and policy are resolved by MAP before the protocol module sees the body.
Every protocol in MAP is bound by the same governance posture. Refusal carries reasons. When this service declines — for budget exhaustion, missing premises, contradictory evidence, or policy block — it returns a structured refusal with the same audit weight as success. Refusals are first-class records; they are not silences.
Dissent is preserved. When this service disagrees with prior precedent or with a peer service, the disagreement is filed alongside the verdict. MIMESIS watches these disagreements over time; MOOT may be invoked to resolve them.
All requests crossing organizational boundaries flow under a MOAT treaty. The treaty fixes capability scope, rate, and economic terms. Calls outside the treaty's envelope are refused at MACS.
Three integration surfaces. All requests pass through MAP.
Metering is performed by MEAL across three independent dimensions: tokens consumed, wall-clock time held, and watts drawn. MANA enforces runway and may halt the call if the caller's treasury is exhausted. See pricing for current rate cards.
This service does not stand alone. The protocols it consults and feeds:
Thirty-five protocols, each with its own contract. Identity to awareness, in seven planes.