Concept

Information governance

Ensure autonomous systems only access and disclose information they were authorized to use — and prove it afterwards. This is not data loss prevention. Aarmos never inspects payloads, never scans content, and never guesses whether a string looks sensitive.

Declared, not detected

Sensitivity is a property you declare about a resource, the same way you declare who owns it. A label is data: a match pattern, a classification, an optional owner and residency. Because labels are declared they are deterministic, and because they are deterministic every existing capability — policy evaluation, simulation, replay, Change Sets, continuity — becomes classification-aware without a new engine behind it.

Four levels

Public — disclosure carries no obligation.
Internal — for people inside the organisation.
Confidential — disclosure needs a reason.
Restricted — disclosure needs authority, and leaves a record either way.

The set is closed on purpose. A lattice that anyone can extend stops being comparable across teams, and a level nobody can rank is a level policy cannot reason about.

Fail closed, opt in

A resource with no matching label resolves to Restricted, and the Console lists it so you can correct it. Declaring the real level usually widens what an agent may do rather than narrowing it.

The boundary stays inert until you declare your first label. An install that has not opted in behaves exactly as it did before — fail-closed semantics apply inside a taxonomy you chose, never as a surprise that blocks a device's own network.

Purpose is declared

Authority can be bound to a purpose — "bug triage", "quarterly reporting". Read the receipt precisely: it proves the authority was granted under that purpose and that every exercise happened under the binding. It does not prove the agent's motive. Intent is not observable, and a guess has no business inside signed evidence.

Writing a classification-aware rule

A rule may carry one sensitivity constraint. It is a single comparison against an already-resolved level, so the gate cost is unchanged.

- allow: [read]
  classification: ">= confidential"   # or: max_classification: internal

Accepted forms are the expression (>= confidential), the explicit object ({ op: gte, level: confidential }), and the max_classification / min_classification sugar. Two constraints in one rule is a compile error, an unknown level is a compile error, and a rule with no constraint applies at every level exactly as before. An unlabelled resource is resolved to Restricted before the comparison runs, and a denial cites the level that governed it.

The disclosure boundary

Outbound calls are checked against the classification the calling principal is authorized to reach and whether the target host sits inside or outside the organisation. Hostname only — consistent with the policy gate and with the decision not to decrypt traffic. What you get is a provable statement about authority and destination, not a claim about payload contents.

Authority wider than use

Aarmos already records what was granted and what was exercised. The difference is arithmetic, and it is the most useful thing the system knows: capabilities granted and never used, authority dormant for a month, purposes bound and never exercised. Each finding names the narrower grant that would close it — as a proposal you review, simulate, and approve. Nothing is revoked automatically; an unannounced revocation is an outage with extra steps.