Working Group
Autonomous Action Runtime Management (AARM)
AARM is an open system category specification for securing AI-driven actions at runtime. Build systems that intercept, authorize, and audit autonomous actions before they execute.
About the AARM Working Group
- Develop and maintain the AARM specification, threat model, and conformance requirements as a vendor-neutral public good
- Enable buyers to objectively evaluate vendor claims against defined criteria, before fragmentation forecloses interoperability
- Preserve architectural choice by specifying what conformant systems must do rather than mandating a single implementation approach
- Accelerate adoption of runtime security for AI agents through practical implementation guidance, reference patterns, and a public conformance review process
- Coordinate research on open challenges in intent inference, data flow tracking, multi-agent coordination, and protection of the security system itself
AARM is part of the Cloud Security Alliance Agentic Control Plane Initiative, announced in April 2026.
- Intercepts AI-driven actions before they reach target systems
- Accumulates Context — tracks session state, the user's original request, prior actions, data accessed, and tool outputs in a tamper-evident, append-only log
- Evaluates the action against static policy and contextual alignment with stated intent
- Enforces one of five authorization decisions: ALLOW, DENY, MODIFY, DEFER, or STEP_UP (require human approval)
- Records tamper-evident receipts capturing action, context, decision, and outcome for forensic reconstruction
AARM is not a product, library, or service you install. It is a specification used to design and build a runtime security system, or to evaluate whether existing solutions meet the bar.
- Irreversibility: Tool executions produce permanent effects. Once a database is dropped or data is exfiltrated, the damage is done.
- Speed: Agents execute hundreds of actions per minute, far beyond human review capacity.
- Compositional risk: Individual actions may satisfy policy while their composition constitutes a breach.
- Untrusted orchestration: Prompt injection and indirect attacks mean the AI layer cannot be trusted as a security boundary.
- Privilege amplification: Agents operate under static, high-privilege identities misaligned with least privilege. Small reasoning failures produce large-scale impact.
Existing tools do not close this gap. SIEM observes events after execution. API gateways verify who is calling, not what the action means. Firewalls protect perimeters, but agents operate inside with legitimate credentials. Prompt guardrails filter text, not actions. Human-in-the-loop does not scale. IAM and RBAC evaluate permissions in isolation and cannot detect compositional threats.
Current Focus Areas
Working Group Leadership
Josh Buker
Research Analyst, CSA
Working Group Co-Chairs
Herman Errico
.png)
Akul Loomba
Diana Kelley
.jpg)
Chris Hughes
Co-Founder and CISO at Aquia
Chris currently serves as the Co-Founder and CISO of Aquia. Chris has nearly 20 years of IT/Cybersecurity experience. This ranges from active duty time with the U.S. Air Force, a Civil Servant with the U.S. Navy and General Services Administration (GSA)/FedRAMP as well as time as a consultant in the private sector. In addition, he also is an Adjunct Professor for M.S. Cybersecurity programs at Capitol Technology University and University of...
| Publications in Review | Open Until |
|---|---|
| Confidential Computing: Simplifying Trust in the Modern Enterprise | May 20, 2026 |
| CSA Zero Trust Program Management Guidance | May 30, 2026 |
| Zero Trust Microsegmentation Guidance | Jun 10, 2026 |
Who can join?
Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.
What is the time commitment?
The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.
Virtual Meetings
Attend our next meeting. You can just listen in to decide if this group is a good for you or you can choose to actively participate. During these calls we discuss current projects, and well as share ideas for new projects. This is a good way to meet the other members of the group. You can view all research meetings here.
Open Peer Reviews
Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.
Premier AI Safety Ambassadors
Premier AI Safety Ambassadors play a leading role in promoting AI safety within their organization, advocating for responsible AI practices and promoting pragmatic solutions to manage AI risks. Contact [email protected] to learn how your organization could participate and take a seat at the forefront of AI safety best practices.