BY NEURABYTE
FRAMEWORKS/AI/AARM
AARM
AI · Cloud Security Alliance

AARM

A runtime governance spec for agentic AI.

Autonomous Action Runtime Management (AARM) is a specification contributed to the Cloud Security Alliance in 2026. It defines what a conformant runtime must do to govern agents in production: intercept actions before execution, bind authority to scope, verify outcomes independently, and emit verifiable evidence. Lore maps its gate, receipts and verification to the specification.

AT A GLANCE
ISSUERCloud Security Alliance REGIONInternational, industry spec CATEGORYAI CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Platform teams evaluating agent runtimes against a neutral bar
02Vendors who want to claim conformance rather than describe features
03Security teams writing agent policy
02. KEY REQUIREMENTS

The parts of AARM that touch what agents do.

Pre-execution interception
Every state-changing action passes a blocking authorization decision before it runs.
Scoped, expiring authority
Permissions are bound to an operation and target, single-use, and time-limited.
Independent verification
Post-state is observed by a verifier separate from the acting client.
Verifiable evidence
Receipts are signed, chained, and checkable without access to the runtime.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against AARM. Where there is no evidence, the report says gap.

LORE CONTROL AARM REFERENCE
Blocking authorization gateAARM §3 interception
Maker–checker approvalAARM §4 authority binding
Signed, hash-chained receiptsAARM §6 evidence
Context disclosure recordAARM §5 input provenance
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Model behavior and prompt safety are outside a runtime spec.
Conformance testing is still being defined by the CSA working group.
05. QUESTIONS
Is AARM a regulation?
No. It is an industry specification. Its value is giving buyers a neutral checklist.
Who else conforms?
Conformant runtimes with cryptographic receipts remain scarce. Ask any vendor to show the evidence chain, not the slide.
Where can we read it?
Through the Cloud Security Alliance.
← PREVIOUSISO 42001 ALL FRAMEWORKS NEXT →DORA
AARM · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for AARM tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.