Live demo · runs in your browser · no network
Every artifact below is produced by the same kernel modules that run in the Aarmos runtime. Press 1 2 3 4 5 6 for individual scenarios or A for all six. Then head to /trust/verify to replay and verify offline.
Scenario 1 · not run
The assistant asks to READ a policy document. The rule allows read, the tenant matches, and the device carries a hardware attestation. Kernel returns ALLOW and signs the receipt.
Press 1 or click Run to gate this request.
Scenario 2 · not run
Same agent now tries to WRITE to the production billing table. The rule ships with a `require_approval` pre-effect obligation. Approval fails; O3 aborts the transaction BEFORE any bytes are written. O3.a still fires the notify obligation so SIEM sees the attempt.
Press 2 or click Run to gate this request.
Scenario 3 · not run
A support agent tries to refund a customer more than it may move on its own. Aarmos does not throw the work away: it records what was attempted, names the authority that is missing, and lets the same attempt run again once that authority is held.
Press 3 or click Run to gate this request.
Scenario 4 · not run
The agent tries to spawn a child agent in a DIFFERENT tenant (contoso-sandbox) and grants it `transact` — a verb the parent doesn't hold. The kernel checks the tenant boundary first, then attenuation. Both fail; no policy can override.
Press 4 or click Run to gate this request.
Scenario 5 · not run
A same-tenant caller (acme-prod) aims a READ at a resource tagged contoso-secure. The tenant-isolation check fires BEFORE any policy evaluates: attested target tenants can only be reached by matching principals. The kernel denies with ERR_TENANT_MISMATCH, the counter increments on the operator dashboard, and no bytes are returned.
Press 5 or click Run to gate this request.
Scenario 6 · not run
The agent tries to READ a customer support ticket whose body contains a raw SSN. The `dlp_scan` inline directive scans the structured payload during the inline phase, matches the SSN pattern with `action: block`, and drops the payload. The kernel records the inline failure in the receipt; no bytes leave the gate. Because dlp_scan runs AFTER any pre-effect reservation, the demo also fires the metering refund path so no budget is burned.
Press 6 or click Run to gate this request.
Take any receipt above to /trust/verify and check it offline against the published AVAR rules.