Aegis-Gateway: A Provable Filter-Ordering Billing Invariant and a Preliminary Case Study of Perimeter Prompt Filtering in a Reactive LLM Gateway

Abstract

This paper presents Aegis-Gateway, a reactive perimeter gateway for Large Language Model (LLM) applications that combines prompt inspection, tenant authentication, token-budget enforcement, distributed tracing, and cross-provider failover. Its primary contribution is a formally stated filter-ordering billing invariant: under explicit architectural assumptions, placing the security filter strictly before the token-budgeting filter guarantees zero client-side token deduction for security-rejected requests. The paper also presents a preliminary pilot case study of a two-tier inspection cascade consisting of an in-memory heuristic pre-filter and a dense-vector prototype matcher. The pilot measures inspection latency and threshold-constrained detection behavior, including the impact of remote embedding latency and benign–attack score overlap. Results are explicitly treated as directional and hypothesis-generating because of the small, single-author, single-run, author-curated evaluation. The paper documents the gateway architecture, formal assumptions, experimental methodology, security controls, limitations, and directions for larger independently sourced follow-up studies.