Trust boundaries

Reference · guarantees

A guarantee you cannot state precisely is not a guarantee. This page says where the Aarmos boundary begins, where it ends, and how the system behaves when part of it is unreachable.

What Aarmos guarantees

  • Decide

    Every governed call is evaluated by a deterministic policy gate before it runs. Same inputs, same verdict, every time.

  • Prove

    Every decision produces a signed receipt that anyone can verify offline with the open verifier — no Aarmos service in the trust path.

  • Bind

    Where the issuer participates, a credential is bound to the authority context that justified it. Enforcement becomes a property of the credential, not of our uptime.

What it does not

  • · Aarmos does not inspect payloads. The proxy sees a hostname, never contents.
  • · Aarmos is not an identity provider and not a secrets manager. It never takes custody of your secrets.
  • · Aarmos does not detect anomalies or classify data by scanning it. Classification is declared.
  • · A workload that is not enrolled is outside the boundary. Nothing infers it into scope.

How coverage is reported

Coverage is reported as counts and named gaps, never as a share. A share needs a denominator — the set of every workload that exists — and that set is not observable. Enrolled workloads carry one of three attestation states:

  • complete — every observed call was named by an adapter.
  • partial — some calls were adapter-named; others were seen as a hostname only.
  • unattested — enrolled by declaration, nothing observed yet.

Declared data contracts

A workload declares the shape of what it sends and receives — field names, a classification per field, and a purpose. The receipt carries a commitment over that declaration, never the values. A field that was never declared is recorded at coverage level unobserved; absence of a declaration is recorded, never read as clean.

Authority-bound credentials

Credentials used by governed workloads are bound to an evaluated authority context. Aarmos answers whether a credential should exist for this principal, this purpose, and this window — not who mints it and not where it is stored. Issuance stays with your existing identity or secrets system. Short validity windows carry the guarantee; revocation is best-effort.

Aarmos never receives, forwards, escrows, persists, proxies, or terminates your credentials. Not durably, not in memory, not for a single connector. Authority is governed by Aarmos; credential custody is governed by your identity infrastructure.

Three assurance states

Resources are reported in exactly one of three states. Nothing is rounded up, and a resource whose issuer cannot mint directly is reported honestly rather than reclassified.

Authority Bound

The issuer participates: credentials are minted directly to the workload against an evaluated authority context, and the binding verifies offline.

Policy Governed

The gate decides and the receipt proves, but the credential exists independently of the authority. No binding.

Observed

Activity is recorded without a governed decision path.

If an enterprise needs an intermediary between the decision and its token service, that broker is theirs and sits outside the Aarmos boundary: decision → your credential broker → your STS → workload.

When something is unreachable

Aarmos control plane unreachable

Previously issued bindings stay valid until they expire; workloads continue within granted authority. No new bindings are minted.

Credential issuer unreachable

No new credential is issued. Existing bound credentials continue until expiry. The gap is reported as a posture degradation, never silently absorbed.

Binding expired

The workload loses authority. Fail closed. Renewal is a governed action requiring a fresh evaluation.

Revocation requested but unpropagated

Best-effort, and documented as such. The guarantee is carried by the validity window, and the window length is a published policy input.

Binding verification unavailable to the relying party

The relying party fails closed and records an unverified_binding disclosure at coverage level unobserved. Absence of verification is never treated as success.

Check it yourself

Contracts and bindings verify from the artifacts alone — no service of ours has to be reachable, and the same verdict comes back from the reference implementation and its standalone mirror. The wire format is published as spec addendum 1.15.

aarmos boundary contract-commit contract.json
aarmos boundary verify-contract contract.json sha256:… --observed customer_id,ssn
aarmos boundary verify-binding binding.json --credential-id key-id-42

Background: information governance · independent verification