AEGIS: Policy-Governed Vulnerability Management for CI/CD Software Security

Abstract

Most vulnerability pipelines remain predictioncentric: they output scores or labels and defer decisions to engineers, even when outputs are compressed, imbalanced, or unreliable under Continuous Integration and Continuous Deployment (CI/CD) shift. We introduce AEGIS (Autonomous Enhanced Guardian for Intelligent Security), a policy-governed framework that treats vulnerability management as a constrained CI/CD decision process in which learned signals serve as evidence and are translated into admissible actions under explicit constraints. AEGIS combines graph-based risk estimation, epistemic uncertainty via stochastic inference, and a symbolic policy guard that maps evidence to auditable decisions: Block, Warn, and Pass. A key design principle is separation of concerns: perception estimates risk while governance determines admissible actions. Irreversible automation is permitted only when risk is high and uncertainty is low, while uncertain cases are deferred to controlled review. This separation makes it possible to revise policy thresholds, cost assumptions, and review budgets without retraining the perception model. We evaluate AEGIS on an extreme-imbalance patch stream used as a stress-test setting and an expanded multi-project dataset that enables more stable estimation of decision outcomes. The evaluation reports the policy thresholds, model settings, symbolic predicates, ablations, and sensitivity settings used in policy replay. Results provide preliminary evidence that policygoverned control supports more interpretable decision behavior under uncertainty, while enabling controlled trade-offs between automation, safety, and review load.