Concept

Organizational governance

A single workspace can answer "was this action governed?". An organization has to answer a second question: was the person or service behind it standing where they claimed to stand? Those two failures are independent. A runtime can be fully governed while the organizational snapshot it relies on went stale three days ago — execution keeps being recorded, but nobody’s standing can be trusted to authorize anything new.

Structure and membership are separate

Aarmos installs two signed datasets, deliberately split by how fast they change:

Topology — the scope tree: organization, business units, teams, environments. Slow-moving, reviewed, rarely re-issued.
Membership — who belongs where, and with what standing. Fast-moving; re-issued as people join, move, and leave.

Each carries a generation number and an issue time. Keeping them apart means a routine joiner-mover-leaver update never requires re-approving the company’s structure, and a re-org never silently republishes stale membership.

Scopes resolve, they don’t branch

Every scope resolves to a chain from the root down. Policy sources attached anywhere along that chain compose into one effective policy— and composition only ever narrows. A team cannot widen what its business unit denied. Membership inherits downward: a member of a business unit is resolvable inside its teams unless the membership dataset says otherwise.

Identity is linked, never inferred

A person shows up as a Google account, an SSO subject, a CI service identity, and a device key. Aarmos never guesses that two of those are the same human because the email matched. An identity link is an explicit, recorded statement binding an issuer-scoped account to a principal. Unlinked identities are usable, but they resolve to themselves — not to anyone’s organizational standing.

Segregation of duties

Constraints are expressed over principals rather than over usernames: the principal who proposes a change cannot be the principal who approves it; two distinct principals are required to open emergency authority. Because constraints resolve through identity links, using a second account for the same human does not satisfy a two-person rule.

Stale authority refuses, it does not stop

When topology or membership goes past its freshness window — or a scope is unknown, or membership is missing — authority-bearing operations are refused: granting delegation, accepting approvals, opening emergency authority. Observation and evidence continue. The runtime keeps governing and keeps recording; it simply stops pretending it knows who is entitled to authorize something new. The refusal names the dataset and the reason, so it is actionable rather than mysterious.

Break-glass is bounded and reconciled

Emergency authority exists, because governance that cannot be exercised in an incident gets bypassed instead. It is deliberately expensive: two distinct principals to open, an explicit scope, a stated reason, and a bounded lifetime. Every use is recorded. A grant opened while state was degraded stays outstanding until an independent principal ratifies or repudiates it — and that outstanding list is visible in the app and in aarmos status until it is closed.

Working with it

aarmos org install-topology topology.json
aarmos org install-membership membership.json
aarmos org show
aarmos org scope <scopeId>
aarmos org whoami --issuer <issuer> --subject <subject>
aarmos org grants
aarmos org break-glass list
aarmos org break-glass reconcile <grantId>

The same state is rendered live under Operations when a runtime is paired — including dataset freshness, refused operations, and emergency authority awaiting review.

Honest limits

Aarmos consumes signed organizational datasets; it is not the system of record for your HR or directory data.
Freshness is evaluated against the issue time in the envelope, so a correct organizational picture still requires you to re-issue membership on a cadence you choose.
Identity links are statements you make. An unlinked account is not evidence that a human is separate — only that nobody said otherwise.