Agent library

13 atomic agents · 5 engine-nodes

Orchestration

OrchestratorOrchestrator

The control plane. Routes work across agents by use-case context, runs fan-out/parallel stages, isolates failures, and enforces the HIL + audit policies. Humans reach it via UI, machines via API, agents via A2A.

looproute → fan out to agents → gather → decide next → enforce policy

inRunContext

outrouted tasks → final state

Static graph (DAG)Dynamic routingCoordinator

ref: AEGIS LangGraph, ARGUS Orchestrator

Retrieval & Knowledge

RetrievalLLM judgment

Agentic retrieval loop that grounds an answer in a corpus and cites its source. The retriever is a swappable tool — the same loop serves internal precedent or live external sources.

loopreformulate → retrieve → assess sufficiency → retry → synthesize + cite

inQuery { text, filters?, k? }

outCitedAnswer { answer, passages[], sources[] }

Vector storeWeb / OWASP / OSV / NVDSQL / internal APIKnowledge graphPrecedent groundingAuthoritative sources

ref: ORACLE (AEGIS), Best Practices (ARGUS)

Understanding

Extraction / ClassificationLLM judgment

Turns an artifact into structured fields or labels against a supplied taxonomy. The output schema is user-defined — you choose what to extract.

loopsingle structured-output call against a target schema / taxonomy

inArtifact { text | record }

outuser-defined schema (configurable)

Data classificationFree-text → structured

ref: CODEX (AEGIS)

Model BuilderLLM judgment

Builds a structured reasoning model of the target (e.g. a knowledge graph of modules, data flows, and trust boundaries) that downstream agents reason over.

loopwalk target → per-unit extract → assemble structured model

inTarget { root, adapter }

outModel { nodes[], edges[], summary }

Codebase adapterCloud / infra adapterApplication graph

ref: Code Understanding (ARGUS)

Entity / Similarity MatcherLLM judgment

Proposes that two records are the same entity using embeddings, surfacing suggestions for human review — never auto-merges.

loopembed → match → propose merges for human review

inRecord[]

outMergeSuggestion[] { a, b, score }

EmbedderMerge suggester

ref: ZTPA entity-suggest (net-new)

Testing & Validation

Hypothesis-TestHybrid

Reasons like a tester: forms specific hypotheses against the model, gathers evidence via a static analyzer, and confirms or rejects each with cited evidence.

loopgenerate testable hypotheses → run analyzer → confirm / reject with evidence

inModel | Target

outFinding[] { claim, evidence, verdict, severity }

Semgreppip-auditnpm auditControl probeSecurity researcher

ref: Security Research (ARGUS)

Runtime-ExecutionHybrid

The only agent that executes the target rather than reading it. Launches it, probes endpoints or drives a browser, and reports live failures.

looplaunch & drive the live target → probe → observe → report

inTarget { launch, endpoints? }

outFinding[] { probe, status, detail }

HTTP runnerBrowser runnerEndpoint prober

ref: Dynamic Tester (ARGUS)

VerificationLLM judgment

Given a checklist or spec, verifies each item against the artifact and reports satisfied / not-satisfied with the supporting evidence.

loopwalk a supplied checklist → check each item against the artifact

in{ artifact, checklist[] }

outResult[] { item, satisfied, evidence }

Control effectivenessSpec ↔ implementation

ref: Best Practices (verify), Business Alignment (ARGUS)

Assessment / ReviewLLM judgment

Pure-LLM design/architecture review over a supplied model — single points of failure, coupling, scalability, missing resilience or observability.

loopfree reasoning over the model against a rubric → findings

inModel

outFinding[] { concern, rationale, severity }

Architecture review

ref: Architecture Review (ARGUS)

Analysis

Synthesis / ReduceHybrid

Consolidates raw findings from many agents into a small set of deduplicated, prioritized items and tracks each across runs (new / persisting / resolved).

loopcollect findings → dedupe → theme → prioritize → track lifecycle

inFinding[]

outGap[] { id, theme, priority, status }

Gap storeGap register

ref: Gap Register, ARBITER (AEGIS/ARGUS)

Action

Action / ExecutionHybrid

Executes a disposition through a connector — open a ticket, notify, pull evidence, remediate — and records the structured result.

loopdecide → call external system → handle result → record

inDisposition | Request

outActionResult { name, ref, status }

ServiceNowJiraSlackEmailVantaRemediation executor

ref: ENVOY (AEGIS)

Reporting

Narrative / ReportLLM judgment

Turns structured results into an audience-shaped narrative — a board summary, a regulator report, or a plain-English explanation of a single finding.

loopstructured data → audience-shaped prose

inData

outReport { sections[] }

Executive summaryExplain a finding

ref: AEGIS narrative, reports

Monitoring

MonitorHybrid

Watches a live signal against a baseline and flags drift or anomalies across assets, vendors, or behavior.

loopsubscribe to signal → baseline → flag drift / anomaly

inSignal stream

outAnomaly[] { entity, kind, score }

SplunkCrowdStrikeEvent streamDrift detector

ref: SENTINEL anomaly (AEGIS)

Interactive

Conversational AssistantLLM judgment

An interactive assistant that answers open-ended questions by calling deterministic engine tools and reasoning over their structured results.

loopmulti-turn user Q&A that orchestrates engine tools

inQuestion (+ history)

outAnswer (+ tool calls)

Tool registryAsk-your-domain

ref: ZTPA 'ask your network' (net-new)

Governance

Guardrail / Policy GateEngine

Deterministic fail-closed pre-filter. Evaluates hard rules and can short-circuit the whole workflow (e.g. a known false-positive is auto-cleared).

loopevaluate hard rules → allow / short-circuit (fail-closed)

inCase

outDecision { pass, rule?, reason }

ref: WARDEN (AEGIS)

Risk ScoringEngine

Deterministic scoring engine. Computes a severity vector and priority from weighted signals — the model never does this math.

loopweights + thresholds → severity vector → priority

inSignals

outScore { vector, priority }

ref: ARBITER (AEGIS), ARGUS severity

Reachability / Graph MathEngine

Deterministic network math over a policy graph: reachability, CIDR overlap, rule shadowing, cross-tool path tracing.

loopCIDR / subnet math · path-trace · shadowing

inPolicyGraph

outPaths[] | Overlaps[]

ref: ZTPA analyzers

Asset / Stack DetectionEngine

Deterministic detection of language, framework, and package manager by inspecting which files exist — never executes project code.

loopfile-existence + manifest inspection (no LLM)

inTarget { root }

outStack { language, framework, pkgManager }

ref: Stack Detector (ARGUS)

Entity ResolutionEngine

Deterministically merges records into canonical entities using stable keys — the confident half of identity resolution.

loopdeterministic identity merge (IP as attribute, not key)

inRecord[]

outEntity[]

ref: ZTPA identity