The agent only sees what its job requires. Declare a purpose and a scope. The SDK strips everything else.

aegis-trust is the trust layer for AI agents. You wrap the function that fetches your data and declare two things: the purpose the agent is acting under, and the scope of fields that purpose maps to. Every field outside that scope is removed before the value ever reaches the agent. It is local-first and fail-closed: if the boundary cannot be enforced, no data is released. The reduction is done by scope / deny_fields; purpose is declared as context and recorded, not enforced as a local authorization decision.

from aegis_trust import shield

@shield(purpose="customer_support", scope=["name", "issue"])
def get_customer(id):
    # your real DB/API call goes here
    return {"name": "Tanaka Taro", "issue": "Login problem",
            "email": "t@example.com", "ssn": "123-45-6789"}

print(get_customer(1))
# → {'name': 'Tanaka Taro', 'issue': 'Login problem'}
# email / ssn are stripped before the agent sees them

This snippet runs as written in LITE mode. The literal record stands in for your real data source. A TypeScript / Node equivalent ships in the same package — see the SDK page.