Skip to main content

​
Description

AARM operates as a proxy server implementing the tool protocol (e.g., Model Context Protocol). Agents connect to the AARM gateway instead of directly to tool servers. The gateway intercepts all tool invocations, accumulates session context, evaluates policies including intent alignment, and forwards permitted requests to backend servers. 
┌──────────┐       ┌──────────────┐       ┌────────────────┐
│  Agent   │──────►│  AARM        │──────►│  Tool Server   │
│  Runtime │       │  Gateway     │       │  (Database)    │
│          │◄──────│              │──────►│  Tool Server   │
│          │       │              │       │  (Email)       │
└──────────┘       └──────────────┘       └────────────────┘
This follows the established pattern of security gateways and service meshes: a trusted intermediary that interposes on communication channels. The approach has proven effective in API security (API gateways), service-to-service communication (Envoy, Istio), and database access (SQL proxies).

​
Trust Properties

PropertyValue
Enforcement pointNetwork level — all tool traffic routes through the gateway
Schema visibilityFull — structured tool protocols provide parameter schemas
Context accumulationSession context tracked across requests, keyed by session ID
Agent modificationMinimal — only the tool endpoint URL changes
Failure modeFail closed — tool calls fail if gateway is unavailable

​
Coverage

ScopeCoverage
CoveredAll tools exposed via protocol servers routed through the gateway
Not coveredDirect HTTP calls bypassing the protocol, raw database connections, local filesystem access, shell command execution
Context limitationSees action requests/responses but not internal agent state or reasoning
For context-aware evaluation, the gateway must receive the original user request via session initialization (recommended), infer intent from action patterns, or integrate with application-level context sources.

​
Action Classification Support

ClassificationSupportNotes
Forbidden✅ FullStatic policy rules match tool/operation patterns
Context-Dependent Deny✅ GoodChecks accumulated context after static ALLOW
Context-Dependent Allow⚠️ PartialRequires original request passed via session init
Context-Dependent Defer⚠️ PartialCan hold execution but may lack signals to resolve autonomously

​
When to Use

  • You control the network between agent and tools
  • Protocol adoption (e.g., MCP) is high in your environment
  • Minimal agent modification is required
  • Self-hosted or cloud-hosted agents on your infrastructure

​
When Not to Use

  • Agent uses non-protocol tools (raw HTTP, direct database connections)
  • Rich reasoning context is essential for policy decisions
  • Agent runs on third-party infrastructure you do not control