Responsibility model
Shared responsibility
Aarmos governs the execution of declared governance. It does not determine what governance ought to be.
Governing an AI decision involves several parties. This page states which of them owns each responsibility, and which artifact records that party’s contribution. Nothing here is inferred at runtime: every customer-owned row corresponds to something the customer declared, and every declaration is recorded on the receipt.
| Responsibility | Aarmos | Customer | Where it is recorded |
|---|---|---|---|
| Decision definitionsWhich business actions are governed, and what facts each one requires. | ✓ | Decision schema, hashed on every receipt | |
| Business rulesWhat counts as an acceptable amount, vendor, or change. Aarmos records the answer; it does not author the rule. | ✓ | Participant contribution on the receipt | |
| Participant implementationThe evaluator that answers, and its declared posture when it cannot. | ✓ | Participant declaration and binding hash | |
| Authority policiesGrants, kill switch, step-up requirements, classification. | ✓ | Signed policy, fingerprinted on the receipt | |
| Decision executionEvaluating the declared governance, deterministically, at the moment of the call. | ✓ | Receipt | |
| CompositionCombining participant contributions into one Verdict under the narrowing rule. | ✓ | Receipt | |
| Evidence generationRecording what happened, sealed so later change is detectable. | ✓ | Signed receipt chain | |
| ReplayReproducing a recorded verdict from recorded contributions, offline. | ✓ | Replay report | |
| VerificationAnyone can check a receipt without us, and without network access. | ✓ | Open verifier | |
| Organizational governanceWho may approve, what the organization requires, and whether declared governance reflects its obligations. | ✓ | Approval receipts |
Why the split matters
If a customer’s evaluator returns an answer that turns out to be wrong, the receipt shows it plainly: who evaluated, which inputs they consumed, what they returned, and how that contribution produced the Verdict. The record does not argue a position. It removes the ambiguity that would otherwise require one.
Related
- Governance guarantees — what the runtime does and does not guarantee.
- Terms of Service — how liability is allocated.
- Trust — verification, keys, and evidence portability.