Your rules. Your detectors. Your policies.

Layer 2 · Custom detector plugin

TypeScript class, registered at boot.

For runtime detectors that need to look at the full tool-call context — agent identity, message history, conversation graph — the Detector plugin contract is one interface. Implement it, mount it, AEGIS runs it on every check call alongside the built-ins.

// detectors/acme-pii-policy.ts
import type { Detector, DetectorResult, CheckCtx } from '@agentguard/gateway-mcp';

export class AcmePIIDetector implements Detector {
  id   = 'acme-pii';
  kind = 'content';

  async evaluate(ctx: CheckCtx): Promise<DetectorResult> {
    // Walk every string in the tool-call arguments.
    const hits = this.findPII(ctx.toolCall.arguments);
    if (hits.length === 0) return { passed: true };
    return {
      passed:   false,
      severity: 'CRITICAL',
      decision: 'block',
      reason:   `PII fields present: ${hits.join(', ')}`,
      ontology_techniques: ['AAT-T5001'],
    };
  }

  private findPII(obj: unknown, out: string[] = []): string[] { /* ... */ return out; }
}

# Mount via tenant-config.yaml (no recompile needed)
detectors:
  - module: detectors/acme-pii-policy.ts
    class:  AcmePIIDetector
    enabled: true

Same interface every built-in detector implements (PI corpus, collusion, sequence anomaly, etc.). Your plugin sees the same context, contributes to the same decision, lands on the same audit row.

Layer 4 · Custom risk weights

Tune the capability scorer to your domain.

The NIST AI RMF capability risk scorer ships with default weights tuned for general-purpose agents. Healthcare, finance, defense each have different category sensitivities — override the weights in tenant config.

# tenant-config.yaml — healthcare deployment
capability_risk:
  weights:
    action:  0.20   # default 0.25
    egress:  0.20   # default 0.25
    secrets: 0.20   # default 0.15
    pii:     0.30   # default 0.15  ← HIPAA = PII weight ↑
    scale:   0.10   # default 0.20

  # Tighten the "blocked combo" rule: HIPAA cares about exfil even
  # without scale, so we count multi-category agents as risky earlier.
  distinct_high_action_bonus_threshold: 2   # default 3

Same scoring algorithm, different priors. The cockpit's "Agent Risk" tile recomputes per tenant.