Judge us against a standard we didn't write.
A documented AI policy doesn't stop an agent's next action — you need an enforcement layer that intercepts, decides, and logs at runtime. We build ours to align with AARM v1.0, the Cloud Security Alliance's open runtime-governance specification, so you can evaluate us against a neutral yardstick instead of our own marketing.
AARM — Autonomous Action Runtime Management — is the Cloud Security Alliance's open specification for governing autonomous AI agents at runtime. Authored at Vanta, donated to the CSAI Foundation in April 2026, and governed by a working group spanning Microsoft, Vanta, Noma Security, Zenity, Elastic, Truist, and Darktrace. It requires that every agent action be intercepted before execution, evaluated against policy with full context, and logged in tamper-evident form — and defines four reference architectures: Protocol Gateway, SDK Instrumentation, Kernel/eBPF Hooks, and Vendor-Native Integration.
The CSA is neutral, vendor-independent, and explicitly focused on agentic AI. A neutral standard lets a buyer evaluate every runtime-governance vendor against one yardstick instead of each vendor's own claims. We chose AARM as our public alignment anchor for exactly that reason — and because the Protocol Gateway pattern in its taxonomy describes the LLM-boundary proxy we had already built.
AARM R4 defines five decisions. All five ship today.
A benign call passes through — policy matched, no regulated content, decision logged.
Text that matches configured PHI, MNPI, or export-control rules is blocked at the boundary. The matched bytes never reach the LLM.
A secret or PII is redacted in-flight. The agent keeps working; the LLM never sees the bytes that matter.
A borderline action holds in an approval queue for human review. The record captures signal and outcome.
A sensitive action requires stronger authorization and holds until the challenge is satisfied. The decision and outcome are recorded.
The spec names four patterns. We implement one, ship a second at the app layer — and say so about the rest.
Our proxy intercepts agent traffic to OpenAI, Anthropic, Bedrock, and Azure OpenAI before dispatch, evaluates it against policy in real time, and writes a tamper-evident receipt per decision — the Protocol Gateway pattern at the LLM-call boundary. We're precise about scope: direct HTTP from agent code, filesystem, shell, and raw database access are out of scope for the proxy and flagged as gaps in our attestation.
AARM defines threat classes but is intentionally silent on how a runtime recognizes regulated content. That's the layer we bring: configurable detectors and rules for HIPAA PHI, SEC MNPI, export-control indicators, PII, secrets, source-code leakage, prompt injection, and more. The standard says "intercept and decide"; we supply the policy vocabulary. Containment enforces your configuration; it does not make legal classification determinations.