Overview
Aegis Shield is the policy engine that decides what each person can do with each document — view it, download the original, print it, modify it, delete it. It evaluates IAM-style policies deterministically: the same identity and context always produce the same decision, explicit Deny always wins, and every result leaves a trace you can inspect. Access control stops being a hope and becomes a reproducible outcome.
Why access control fails without determinism
Most document leaks do not require breaking encryption. They happen because someone had more access than anyone intended: a folder inherited from a reorganized team, a share that outlived its project, a contractor account that was never downgraded.
The root cause is ambiguity. When permissions accumulate across nested groups, legacy shares, and platform quirks, nobody can answer a simple question with certainty: can this person read this file right now? If your own team cannot answer it, auditors and incident responders cannot either.
Deterministic access control means the platform answers that question every time, with the same result, and can show its work. That is the design premise of Aegis Shield: default-deny, explicit Allow grants, explicit Deny always wins, and every decision is traceable to a policy statement.
- No hidden state: permissions come from policies evaluated on the request, not from accumulated clicks.
- No silent escalation: an Allow must be explicit, and a Deny can override any grant.
- No guesswork after the fact: each decision can be traced back to the statement that produced it.
How a request becomes a decision
Every action against a document — listing a folder, reading a page, downloading the original file — is evaluated against the policies that apply to that identity: the groups the user belongs to, plus any inline exception attached directly to the user.
Policies are IAM-style JSON documents scoped to URN resources with wildcard support, from a whole mount (urn:aegis:*) down to a single folder subtree or document. The evaluation is deliberately boring: start from deny, apply explicit grants, let explicit denials win, and check conditions such as MultiFactorAuthPresent when a statement demands a second factor.
Network context joins the same decision. CIDR-based IP rules can bypass Turnstile or 2FA for trusted ranges, or automatically assign a group or Shield policy to requests from a known network — with server-IP auto-detection and a rule tester, so the mapping is verified rather than assumed.
Nine actions, reviewed like code
Folder-level ACLs in Aegis Shield cover nine actions: list, view, download raw, print, create, modify, delete, change permissions, and lock. They can be scoped to a folder, its children, or both, with optional expiry — and inheritance can be deliberately broken and restored when one subtree needs different rules.
The critical distinction is view versus download raw. Viewing renders sealed pixels through the zero-cleartext pipeline; obtaining the original file requires an explicit grant. That single split removes the most common leak path without blocking legitimate work.
- Build policies in a visual rule builder and review the equivalent JSON in a read-only view — suitable for version control and change review.
- System policies are immutable; custom policies clone and evolve, so the baseline cannot drift by accident.
- Delegate operational capabilities with scoped admin actions such as admin:ShieldManage, admin:AuditView, or admin:StorageManage — without handing over the keys.
- Map physical SAN/NAS storage into logical, policy-governed folders; clients never see the underlying filesystem layout.
Prove the policy before it ships
The most dangerous policy is the one nobody tested. Aegis Shield includes an effective-access simulator: point the calculator at any user or group and any VFS path, and it returns the full capability matrix plus a decision trace showing whether the outcome came from super admin status, a direct ACL, or an inherited one.
That turns access review from a meeting into a measurement. Before publishing a policy change, you can show exactly what it grants and revokes for every affected identity — and after an incident, reconstruct why a decision was allowed without relying on memory.
Deterministic decisions also make compliance evidence cheaper: ISO 27001 auditors ask for access control that is designed, implemented, and monitored. Reproducible decisions and exportable logs answer all three questions with records instead of narrative.
How the policy engine fits the rest of the stack
Access control is one layer, and it works best when the other layers assume it can fail. A request that passes a view policy still receives rasterized pixels, never the original file, so a compromised endpoint never holds a document; the original is released only on an explicit download-raw grant. Every rendered page carries a forensic watermark tied to the viewer and session.
- Zero-cleartext viewing: the pipeline behind server-side PDF rasterization means a view grant never equals file disclosure.
- Insider awareness: policies limit blast radius even for legitimate users, complementing insider threat controls.
- Sovereign deployment: policy evaluation runs locally, so on-premise and air-gapped environments keep full enforcement.
- Full transparency: the Security Model and the Administration console document every action, condition, and audit record in detail.
Access control is where document security succeeds or fails quietly. Permissions that accumulate without review produce the worst outcome: a system nobody can explain and nobody can audit. Aegis Shield replaces that drift with default-deny determinism, explicit grants, and a simulator that proves the result before it ships. If your team is consolidating permissions, preparing for an audit — or simply cannot answer who can download which file — request a demo and we will run the simulator against your own folder tree.