Working Group
Autonomous Action Runtime Management (AARM)
AARM is an open system category specification for securing AI-driven actions at runtime. Build systems that intercept, authorize, and audit autonomous actions before they execute.
Working Group
About the AARM Working Group
The Autonomous Action Runtime Management (AARM) Working Group, operating under the Cloud Security Alliance Agentic Control Plane Initiative, is building the open system category specification for securing AI-driven actions at runtime. The security posture of AI systems is increasingly determined not by what models say but by what they do, and existing security paradigms were not built for irreversible, high-velocity, compositional actions executed by agents under static high-privilege identities.
AARM is an open system specification. It defines what a runtime security system must do, not how to build it. The Working Group exists to:
- Develop and maintain the AARM specification, threat model, and conformance requirements as a vendor-neutral public good
- Enable buyers to objectively evaluate vendor claims against defined criteria, before fragmentation forecloses interoperability
- Preserve architectural choice by specifying what conformant systems must do rather than mandating a single implementation approach
- Accelerate adoption of runtime security for AI agents through practical implementation guidance, reference patterns, and a public conformance review process
- Coordinate research on open challenges in intent inference, data flow tracking, multi-agent coordination, and protection of the security system itself
AARM is part of the Cloud Security Alliance Agentic Control Plane Initiative, announced in April 2026.
Stay informed about AARM and Participate. Help shape the future of runtime security for AI agents. Sign up to receive information on AARM specification updates, conformance reviews, and Working Group activities.
What an AARM System Does
A system conforming to AARM:
- Intercepts AI-driven actions before they reach target systems
- Accumulates Context — tracks session state, the user's original request, prior actions, data accessed, and tool outputs in a tamper-evident, append-only log
- Evaluates the action against static policy and contextual alignment with stated intent
- Enforces one of five authorization decisions: ALLOW, DENY, MODIFY, DEFER, or STEP_UP (require human approval)
- Records tamper-evident receipts capturing action, context, decision, and outcome for forensic reconstruction
AARM is not a product, library, or service you install. It is a specification used to design and build a runtime security system, or to evaluate whether existing solutions meet the bar.
The Runtime Security Gap
Traditional security paradigms fail to address five characteristics of AI-driven actions:
- Irreversibility: Tool executions produce permanent effects. Once a database is dropped or data is exfiltrated, the damage is done.
- Speed: Agents execute hundreds of actions per minute, far beyond human review capacity.
- Compositional risk: Individual actions may satisfy policy while their composition constitutes a breach.
- Untrusted orchestration: Prompt injection and indirect attacks mean the AI layer cannot be trusted as a security boundary.
- Privilege amplification: Agents operate under static, high-privilege identities misaligned with least privilege. Small reasoning failures produce large-scale impact.
Existing tools do not close this gap. SIEM observes events after execution. API gateways verify who is calling, not what the action means. Firewalls protect perimeters, but agents operate inside with legitimate credentials. Prompt guardrails filter text, not actions. Human-in-the-loop does not scale. IAM and RBAC evaluate permissions in isolation and cannot detect compositional threats.
The gap lies at the intersection of prevention and context-awareness. AARM fills this gap.
Current Focus Areas
Specification Maintenance and Evolution. AARM v1.0 is published. The Working Group maintains the specification through versioned releases on GitHub, with formal change control and public peer review for substantive amendments.
Threat Model. AARM addresses eleven attack vectors specific to AI-driven actions: prompt injection, malicious tool outputs, confused deputy, over-privileged credentials, data exfiltration, goal hijacking, intent drift, memory poisoning, cross-agent propagation, side-channel leakage, and environmental manipulation. The Working Group continues to expand the threat model as new attack patterns emerge in the agent ecosystem.
Conformance Requirements. Systems claiming AARM compliance must satisfy nine requirements (R1 through R9), grouped into AARM Core (R1 through R6, baseline runtime security guarantees) and AARM Extended (R1 through R9, comprehensive runtime security with operational maturity features). Conformance reviews are conducted by independent reviewers and published openly.
Implementation Architectures. AARM defines four implementation architectures with distinct trust properties: Protocol Gateway, SDK / Instrumentation, Kernel / eBPF, and Vendor Integration. The Working Group publishes architecture selection guidance and layered deployment patterns for defense-in-depth.
Builders Registry. A public registry of conformant and aligned implementations, enabling buyers to discover vendors and open-source projects that meet AARM requirements.
Benchmarks. The Working Group is developing open benchmarks to measure AARM-conformant systems on detection efficacy, decision latency, and resilience against the eleven threat categories, giving buyers and builders a shared yardstick for runtime security performance.
Working Group Leadership
Josh Buker
Josh Buker
Research Analyst, CSA
Working Group Co-Chairs
Herman Errico
Herman Errico
.png)
Akul Loomba
Akul Loomba
Diana Kelley
Diana Kelley
.jpg)
Chris Hughes
Chris Hughes
Founder, Resilient Cyber
Chris is the founder of Resilient Cyber, a leading cybersecurity newsletter and podcast reaching tens of thousands weekly. With over 20 years of cybersecurity experience spanning the Department of Defense, Federal Government, and commercial organizations, Chris has held roles including CEO, CISO, Security Engineer, and Security Architect, giving him a practitioner's perspective on the real-world challenges security team...
| Publications in Review | Open Until |
|---|---|
| The VulnOps Operating Model | Aug 19, 2026 |
| Zero-to-Hero: STAR or STAR for AI? A Decision Tree | Aug 21, 2026 |
| Zero-to-Hero: STAR Certification Roadmap | Aug 21, 2026 |
| Zero-to-Hero: STAR for AI Certification Roadmap | Aug 21, 2026 |
Who can join?
Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.
What is the time commitment?
The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.
Virtual Meetings
Attend our next meeting. You can just listen in to decide if this group is a good for you or you can choose to actively participate. During these calls we discuss current projects, and well as share ideas for new projects. This is a good way to meet the other members of the group. You can view all research meetings here.
Aug
21
Fri, August 21, 9:00am - 9:55am PDT
AARM Working Group
See details
Recurring meeting for the AARM Working Group. We will discuss active projects, blockers, answer questions, etc.
- Zoom Link: https://csaurl.org/aarm-call
- Website: https://aarm.dev
- Slack Channel: https://csaurl.org/aarm-slack
Sep
4
Fri, September 4, 9:00am - 9:55am PDT
AARM Working Group
See details
Recurring meeting for the AARM Working Group. We will discuss active projects, blockers, answer questions, etc.
- Zoom Link: https://csaurl.org/aarm-call
- Website: https://aarm.dev
- Slack Channel: https://csaurl.org/aarm-slack
Sep
18
Fri, September 18, 9:00am - 9:55am PDT
AARM Working Group
See details
Recurring meeting for the AARM Working Group. We will discuss active projects, blockers, answer questions, etc.
- Zoom Link: https://csaurl.org/aarm-call
- Website: https://aarm.dev
- Slack Channel: https://csaurl.org/aarm-slack
Oct
2
Fri, October 2, 9:00am - 9:55am PDT
AARM Working Group
See details
Recurring meeting for the AARM Working Group. We will discuss active projects, blockers, answer questions, etc.
- Zoom Link: https://csaurl.org/aarm-call
- Website: https://aarm.dev
- Slack Channel: https://csaurl.org/aarm-slack
Open Peer Reviews
Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.
Premier AI Safety Ambassadors
Premier AI Safety Ambassadors play a leading role in promoting AI safety within their organization, advocating for responsible AI practices and promoting pragmatic solutions to manage AI risks. Contact [email protected] to learn how your organization could participate and take a seat at the forefront of AI safety best practices.