Why govern AI?

A log tells you an agent called send_email at 10:14. Governance is what refused the call at 10:14:00.000 because the recipient was outside the allow-list, the capability wasn't delegated, or the kill switch was on.

Every governed tool call, action, and escalation runs through the policy gate before the effect happens. Allow, deny, modify, ask — the decision is the product, not a side-effect written down after the fact.

• Govern before execution — not after.
• Predictable microsecond-scale p99 on the hot path (≈1µs steady, ≈50µs during policy updates).
• Same decision, same inputs, same policy — every time.

"Why did the agent do that?" is the question that stalls every incident review. Without a tamper-evident record of the inputs, the policy version, and the obligations that ran, the answer is a story reconstructed from partial logs.

Replay takes a receipt and reruns the same decision against the same governance policy, deterministically. Same verdict, same reason, same rule — or a diff you can argue about.

• Every decision is a signed, tamper-evident step.
• Policy version bound at decision time, not query time.
• Reproduce a verdict from a receipt alone.

Compliance, incident response, and honest post-mortems all need one thing: evidence a third party can check without calling us. A dashboard screenshot isn't evidence. A JSON row in someone else's database isn't either.

Aarmos receipts follow an open standard (CC BY 4.0 spec, Apache-2.0 code). They are signed, tamper-evident, and verifiable offline with an independent, clean-room reference verifier. The auditor doesn't need our uptime, our API, or our goodwill — just the receipt and the verifier.

• Open receipt standard — CC BY 4.0 spec, Apache-2.0 code.
• Independent reference verifier — clean-room, runs anywhere.
• Verifiable years after the runtime is gone.

Teams don't run one LLM, one framework, or one protocol. They run OpenAI in one product, Ollama in another, LangGraph here, a raw HTTP adapter there — and MCP, OpenAPI, deep-links, and custom APIs alongside each other.

A Governance Runtime that only works for one of them is one that gets bypassed. Aarmos governs at the action boundary, not the framework boundary — so the same policy, the same receipts, and the same replay work across every runtime.

• BYO-LLM — Ollama, OpenAI, Anthropic, Azure, your keys.
• Protocol-agnostic — MCP, OpenAPI, deep-links, custom APIs.
• One policy language across every framework.

When an agent decides whether to send that email, delete that row, or pay that invoice, the policy check should not depend on a hosted request path, a shared tenant, or a network round-trip to us. It should run on the machine the agent is running on, with the credentials the operator controls.

Local-first means the gate is on-device, the credentials stay on-device, and the receipts are yours. Aarmos never sees your prompts, your tools, or your data — and can't be subpoenaed for what it never held.

• On-device policy gate — no hosted request path.
• Credentials stay on the operator's machine.
• Offline by default; sync is an opt-in for teams.