Governance vs security
- Security stops the outsiderauthn, encryption, patching
- Governance binds the insideryour own agent, acting in scope
- The same receipt shows bothwho got in, what they were allowed to do
01The Problem
"We already have security." True — and unrelated. An agent with a valid token, on a patched machine, over TLS, can still refund the wrong customer, email the wrong file, or merge the wrong branch. Nothing was breached; something was allowed.
02Why existing approaches fall short
Security tools ask should this request come in?. Governance asks should this action go out? They share vocabulary — policy, role, permission — and are constantly confused for each other in AI deployments.
03The concept
Security is about untrusted parties. Governance is about trusted parties acting outside their scope. Both are necessary; neither substitutes for the other.
04How Aarmos applies it
Aarmos is a governance runtime. It sits inside the trust boundary, after the request has been authenticated, and decides what the agent is allowed to do next. The receipt it produces records the identity and the verdict — so a later reader can see both halves.
05Example
A support agent authenticates cleanly with a valid OAuth token — security is satisfied. The agent then tries to refund $9,400. Governance evaluates the refund policy for that agent's authority and returns ask. Security never rejected the request; governance shaped what happened next.
06Mini-FAQ
- Isn't this just authorization?
- Authorization is a mechanism; governance is the discipline of deciding, versioning, and proving the rules that authorization enforces.
- Do I still need a WAF, IAM, and secrets manager?
- Yes. Governance runs after those have done their job. It never replaces them.
- Where does compliance fit?
- Compliance is downstream of both. Governance produces the evidence compliance teams already ask for.