Overview

Every model deployment in Aegis Sovereign is expressed as a GitOps manifest — a YAML file with the model version, target environment, and the compliance evaluation ID that signed it off. Manifests are validated by OPA/Rego policy bundles before any deployment proceeds. Changes to manifests require approval from the configured workflow (Legal, CISO, or custom approver groups) before they merge.

GitOps & deployment pipeline — GitOps — deployment manifests with traffic splits and commit SHAs, plus the compliance-gated Validate → Scan → Deploy → Activate pipeline.

Compliance-Linked Deployment Manifests

The platform auto-generates a deployment manifest when a model passes all promotion gates. The compliance_eval_id field is immutable — it chains the deployment to the specific evaluation run that signed it off. Attempting to deploy without a valid eval ID is blocked by OPA.

yaml

Auto-generated deployment manifest

1apiVersion: aegissovereign.io/v1
2kind: ModelDeployment
3metadata:
4  name: fraud-detection-v4
5  namespace: production
6spec:
7  model_id: mdl_fraud_v4
8  version: "4.0.0"
9  compliance_eval_id: eval_a1b2c3d4          # immutable — links to passing eval
10  frameworks_passed:
11    - eu-ai-act: 91
12    - sr-11-7: 87
13    - nist-ai-rmf: 83
14  bias_dir: 0.94
15  robustness_score: 0.78
16  approved_by:
17    - role: legal
18      user: sarah.chen@acme.com
19      timestamp: "2026-04-18T14:22:00Z"
20    - role: ciso
21      user: james.okafor@acme.com
22      timestamp: "2026-04-18T15:05:00Z"

OPA / Rego Policy Bundles

Store your Rego policy files in the connected Git repository. The platform syncs bundles on push and evaluates them on every model action. Write policies to enforce compliance score thresholds, block high-risk models, or require specific approvals.

bash

Example Rego policies

1# policy/compliance_gate.rego
2package sovereign.deployment
3
4default allow = false
5
6# Block deployment if primary compliance score is below threshold
7allow {
8    input.compliance_score >= 75
9    input.bias_dir >= 0.80
10    input.robustness_score >= 0.60
11}
12
13# Always block prohibited-use models regardless of scores
14deny[msg] {
15    input.tags.use_case == "prohibited"
16    msg := "Prohibited use case — deployment blocked by policy"
17}

Multi-Role Approval Workflows

Configure approval requirements per environment. Approvers receive email + Slack notifications and can approve or reject from the platform UI or the MCP Server. Timeout and escalation rules are supported.

bash

Configure approval workflow

1curl -X POST https://sovereign.yourcompany.com/api/v1/workspaces/WS_ID/approval-workflows \
2  -H "Authorization: Bearer $TOKEN" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "environment": "production",
6    "required_approvers": [
7      { "role": "legal",  "min_count": 1 },
8      { "role": "ciso",   "min_count": 1 }
9    ],
10    "timeout_hours": 48,
11    "escalate_to": "admin"
12  }'