Governed Actions
A Governed Action names one class of consequence — sending a model call, sending an email — and binds it to the facts a decision needs, the paths that can actually stop it, and a fixed evidence budget. Definitions are data: they describe, they never decide.
Aarmos productionizes Model Calls and External Communications on confirmed governed paths today. Other consequence types, including Data Movement and Financial Actions, use the same governance architecture but require their own production enforcement adapters before Aarmos claims enforcement.
How to read one
- Facts — what the decision relies on. Aarmos never asserts or infers them; each value comes from the participant entitled to assert it.
- Enforcement paths — every path where the consequence can occur is either enforced or a named bypass. There is no third category, and coverage is reported as counts, never a percentage.
- Evidence — projected under a fixed byte budget. Attribution and validity are never truncated.
- State — read in five dimensions (intent, policy, enforcement, coverage, health) so "enabled" can never be mistaken for "enforcing everywhere".
Governed Actions add no fields to receipts. Verification is unchanged: aarmos verify and the open avar verifier read the same records as before.
Installed definitions
- External communicationsemail.sendsupported
The boundary where a message reaches a recipient and cannot be recalled. One path is enforced today: the governed adapter in front of a single hosted mail API, which decides before any request is issued and binds the authorization to the complete canonical message effect. Messages sent by a process holding its own provider or SMTP credentials are a declared bypass, and delivery to a person is never observed — only what the provider said about the submission.
0/1 enforced paths observed · 2 named bypasses · 1 outside scope · 1 declared path not implemented
- Model callsmodel.invokesupported
Governs the boundary where context leaves the trust boundary and reaches an inference provider. One path enforces today: the loopback gateway, which decides before the connection to the provider is opened and binds the Decision to a digest of the exact request it authorized. Paths Aarmos cannot intercept, and paths it intends to govern but has not implemented, are named rather than counted as covered.
0/1 enforced paths observed · 2 named bypasses · 1 outside scope · 1 declared path not implemented
Operating them
From the CLI: aarmos ga list, aarmos ga show <id>, aarmos ga enable <id> (shadow first), aarmos ga shadow <id> --review, then aarmos ga promote <id>. Enforcing mode is refused until a shadow review has actually been recorded, and promotion is refused if the definition changed after that review. See the CLI reference.