Threat model & known limits

• Policy attenuation. Every child action is a subset of the parent — no child can grant itself more than the invite provided.
• Tenant invariant. A receipt's tenant is bound in the policy hash; a mismatch fails offline verification.
• Atomic metering. Call-ceilings and repeat-guards are decremented before dispatch; a crash mid-call cannot double-spend.
• Workspace vault isolation. OAuth tokens and bearer profiles are stamped to the workspace that wrote them; a different active workspace cannot read, list, or delete them.
• Connector egress. FQDN allow-lists and post-DNS-resolution SSRF checks prevent the L7 proxy from being turned into a metadata-service tunnel or an internal-network probe.

• OS-level egress. Aarmos enforces at L7 (application / middleware). A process on the same machine that opens its own socket bypasses the connector layer entirely. Full OS enforcement requires the tripwire daemon (roadmap Phase 3).
• Compromised device. If the host is rooted or a browser extension has full page access, in-memory secrets are reachable regardless of the vault. The vault protects against opportunistic script access, not full host compromise.
• Backend model provider. When BYO-LLM is used, prompt content leaves the device the moment it hits the provider's endpoint. Aarmos redacts before dispatch; it cannot un-send.

• The microsecond-scale gate is the policy check only. Network, model, and I/O latencies of the underlying tool call are not counted in that number.
• AVAR receipts are verifiable forever only for as long as the signing key material remains checkable — anchor rotations are logged in the anchor chain, and the verifier is offline.
• DoH-based DNS recheck. The MCP proxy re-resolves target hostnames via a public DoH resolver before fetch. A resolver outage falls back to the string-based guard, not through to an open proxy.

Coordinated disclosure at security@aarmos.io. We fix P0 issues before shipping public copy about them; this page is updated in the same release.