Agent Security Policy · asp/1 · draft

Policy-as-code, in YAML your reviewers can read.

ASP is Aarmos's declarative YAML authoring surface for signed policy bundles. It compiles deterministically to the same canonical JSON, signed with the same Ed25519 key — the runtime doesn't change. What changes is your DX: lint, golden-test, sign, and ship policies through your existing GitOps pipeline. Authoring, signing, and enforcement all run on your machines — no Aarmos-hosted control plane is required for policy evaluation or receipt signing.

What the runtime enforces. On the Aarmos CLI's enforcement paths, the runtime applies a policy's egress rules to outbound web requests sent through the local Aarmos proxy, matching host names. Without an egress allowlist in effect, only hosts on the deny list are refused; every other outbound request is allowed.

The signed bundle that aarmos policy sign writes does not carry the egress section. On the CLI, make the YAML file itself effective: aarmos policy import --from asp.yaml, then preview, review and activate it.

The allow / deny tool rules, scopes, human_oversight and kill_switch sections are checked when you run aarmos lint and aarmos test. The CLI's enforcement paths do not apply them to calls.

Structured tool calls are enforced separately. A call made with aarmos tool call is sent only when an activated policy holds a reviewed binding for that server, tool and tool definition. Unbound, changed or mismatched calls are refused before anything is sent. Bindings currently support two action types: sending email and invoking a model.

Author-time only. The signed bundle on-wire is byte-identical to a policy bundle minted directly. Runtimes that already accept signed policy bundles (bundle format version 1) verify ASP-authored policies without upgrade.

The pipeline

# author
$ $EDITOR asp.yaml

# validate offline
$ aarmos lint --strict

# golden-test decisions
$ aarmos test policies/tests

# sign for shipment
$ export AARMOS_POLICY_PRIVATE_KEY=...
$ aarmos policy sign asp.yaml --out policy.signed.json

Example

version: 1
metadata:
  issuer:
    name: "Acme Corp Security"
    pubKey: "BASE64_RAW_32B_ED25519_PUBKEY"
  issuedAt: "2026-07-09T00:00:00Z"
  expiresAt: "2027-07-09T00:00:00Z"

# Enforced by the runtime: outbound requests, by host name
egress:
  allowlist: ["mcp.internal.acme.io"]
  deny: ["*.pastebin.com"]

# Checked by aarmos lint / aarmos test
allow:
  servers: ["https://mcp.internal.acme.io"]
  tools:   ["github__read_*", "jira__list_*"]

deny:
  tools: ["*__delete_*", "shell__*"]

scopes:
  github: ["repo:read", "issues:read"]

human_oversight:
  require_approval_for: ["write", "admin", "delete", "payment"]

kill_switch:
  default: false

CLI

aarmos lint [path] — schema, shadowed rules, dangerous allows.
aarmos test [path] — run golden fixtures (given → decision).
aarmos policy compile <asp.yaml> — canonical JSON to stdout.
aarmos policy sign <asp.yaml> — Ed25519-signed bundle.
aarmos policy keygen — new signing keypair.

Full spec

The normative schema, canonicalization rules, and conformance criteria are not currently publicly published. Reference compiler: the aarmos CLI.

← Back to docs · Trust & governance · AVAR spec