AEGIS: Agent Execution Governance and Integrity Protocol — A Structured Review and Reference Architecture for AI Agent Action Accountability

When AI agents act across organizational systems, no standardized recording mechanism exists to reconstruct their cross-platform behavior in a tamper-evident form. Existing audit infrastructure either relies on agents to record their own actions (falsifiable, as documented incidents show) or fragments across platform logs that cannot be cryptographically linked. This paper specifies AEGIS (Agent Execution Governance and Integrity Protocol) for third-party recording of AI agent runtime actions. Five academic contributions follow. First, a structured review of 25 accountability-relevant systems (20 academic, 5 industry) identifies seven design requirements (D1-D7) derived from regulatory and security literature; no surveyed system satisfies the six core dimensions (D1-D4, D6-D7), a result stable under D5 exclusion, with inter-rater reliability on a 42-rating subset yielding weighted Cohen's kappa = 0.31 (92.9% adjacent agreement). Second, a threat model (T1-T8) is formalized from six empirical AI-related incidents. Third, the AEGIS protocol is specified: event schema, hash-chain construction, and verification interfaces using standard primitives (SHA-256, Ed25519, JCS canonicalization), positioned to satisfy EU AI Act Article 12 (effective August 2, 2026) and aligned with NIST AI RMF 1.0, ISO/IEC 42001:2023, and Singapore IMDA's Agentic AI Framework. Fourth, a three-layer reference architecture with open-source implementation is validated by a 202-test suite covering protocol conformance, tamper detection, serialization integrity, cross-adapter invariants, and data non-contact, with empirical performance measurements. Fifth, ethical implications — notably an "accountability arbitrage" mechanism — are included as deployment context; deeper treatment is deferred to a companion paper. Reference implementation: https://github.com/crabsatellite/aegis-protocol