Governance recipes: put LLM traffic under Aarmos policy

Same gate. Same receipts. Any provider. Aarmos governs the calls your agent makes — swapping the LLM changes three env vars, not your policy.

The Aarmos CLI is not publicly distributed. Commands here are reference examples, not instructions you can run today.

Pick a provider

AWS Bedrock
Claude / Nova / Llama via Bedrock Runtime API.
Google Vertex AI
Gemini / Claude on Vertex, service-account auth.
Azure OpenAI
GPT-4/5 deployments via Azure endpoints + API version.
Ollama (local)
Local model path; localhost proxy still records receipts.
OpenAI + Anthropic
Direct APIs with user-owned keys.

None of the recipes require code changes in your agent — Aarmos enrols agents at the proxy layer via eval "$(aarmos env)", which exports authenticated proxy credentials for the running session. No CA certificate to install: the proxy tunnels HTTPS by hostname and never decrypts it.