Governed AI Workflows
AI agents that can call real tools — email, calendar, databases, APIs — need a runtime where governance is the runtime, not a bolt-on. Aarmos is that runtime: you build and run agents on-device, and governed tool calls are policy-gated before they fire. Proof falls out the other side as a signed receipt.
Governance isn't a stage — it's the runtime
Governed paths have no unpolicied execution route: every call the agent proposes on them passes through the same on-device gate, with rules you own and a receipt you can read. The mechanisms below are what the runtime is made of.
- Policy you write, not a vendor default. Set per-tool rules — allow, ask, or deny — for every connector. Import an admin-signed governance policy to pin allowed tools and OAuth scopes across a fleet.
- Consent before execution. The gateway surfaces the exact tool call in plain words before it fires. Approve once, for the session, or for 24 hours. Defaults are conservative — writes, sends, deletes, and payments require explicit approval.
- Signed Receipts, not log files. Every decision is appended to an on-device chain where each Receipt links to the one before it. On Evaluation and above, full run traces are signed per device and exportable as JSONL — the evidence you can hand an auditor.
- Break-glass kill switch. One tap suspends every outbound tool call and locks the vault. In-flight sessions abort, and the disabled state persists across reloads until an operator or a fresh signed governance policy explicitly resumes.
How it works in practice
Agent proposes a tool call
The LLM picks a tool — send_email, update_calendar, query_database — and the gateway intercepts it before any packet leaves the device.
Gateway checks policy
The call is matched against your rules, any active signed org governance policy, and the tool's capability class from the 8-verb model (read, write, delete, execute, communicate, delegate, transact, control).
Operator sees the call
You get the tool name, arguments, and destination in plain words. One tap to allow, ask, or deny. Session overrides are time-boxed and logged.
Receipt is written
The decision and the full trace are written to the on-device ledger as a chained Receipt — signed for off-device verification.
Local-first governance
The policy engine, vault, audit ledger, and kill switch all run in your browser. Your rules are enforced on-device, so governance does not depend on network reachability or a vendor's uptime. Admin-signed governance policies are verified locally with WebCrypto and cached with a 7-day grace period so offline devices keep enforcing the last-valid rules.
For teams, a centralised audit relay aggregates evidence packages from enrolled devices so your SIEM sees a unified stream. Device signing keys stay on the device — the relay stores and forwards signed bundles; it does not sign them.
Aarmos governs tool calls routed through its gateway. It does not audit the internals of third-party MCP servers or LLM providers, and it cannot protect against a compromised device or malicious browser extension. Read the full scope on the threat model.