Guarded Autonomy for Satellites: A Policy-Gated AI Agent Framework for Safe Onboard Fault Response

Spacecraft increasingly face faults that onboard rule-based systems were never designed to handle, yet flight operators cannot give a probabilistic AI agent direct control of a vehicle. This paper presents AEGIS-Sat, a framework that places a deterministic policy gate between an AI agent and the spacecraft. The agent observes a fault and proposes a single structured recovery action; it can execute nothing itself. A policy gate, written as human-readable YAML, rules on every proposal — AUTO (execute now), AUTO+LOG (execute and flag for ground review), ESCALATE (hold safe and request ground approval), or DENY (blocked) — after checking hard safety invariants and a context-adaptive autonomy envelope that tightens the tiers during communications blackout and eclipse and widens them as power margin recovers. Every proposal, ruling, and state snapshot is recorded in a hash-chained, tamper-evident audit ledger. In a fault-injection evaluation (6 scenarios × 3 setups × 100 episodes = 1,800 episodes), an unguarded agent recovered from 88% of episodes but executed 75 unsafe actions. The guarded agent executed zero unsafe actions, recovered in 100% of episodes (67% full recovery, 33% safe-state recovery), and lost no spacecraft, at the cost of 659 ground escalations. A rule-only FDIR baseline was equally safe but fully recovered from only 33% of episodes. The gate and benchmark are anchored on real telemetry: a deliberately simple logistic detector over ESA's OPS-SAT-AD dataset reaches AUC 0.887, detecting 58% of anomalous segments at a 2.2% false-alarm rate. Gating an untrusted controller is not new — the approach is Simplex-inspired runtime assurance translated to agent-based fault response. The contribution claimed here is the combination: readable policy tiers, a context-adaptive envelope, an open unsafe-action benchmark, and a tamper-evident audit trail, evaluated head-to-head on injected faults.