Components Overview

Architecture

An AARM system consists of six components working together:

┌─────────────────────────────────────────────────────────────┐
│                       AARM SYSTEM                           │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   ┌──────────────────┐      ┌──────────────────┐            │
│   │ Action Mediation │ ───► │ Policy Decision  │            │
│   │ Layer (AML)      │      │ Point (PDP)      │            │
│   └──────────────────┘      └────────┬─────────┘            │
│                                      │                      │
│                                      ▼                      │
│                             ┌──────────────────┐            │
│                             │ Policy Enforce-  │            │
│                             │ ment Point (PEP) │            │
│                             └────────┬─────────┘            │
│                                      │                      │
│         ┌────────────────────────────┼────────────────┐     │
│         ▼                            ▼                ▼     │
│  ┌─────────────┐          ┌──────────────┐    ┌─────────┐   │
│  │  Approval   │          │   Receipt    │    │Telemetry│   │
│  │  Service    │          │  Generator   │    │Exporter │   │
│  └─────────────┘          └──────────────┘    └─────────┘   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Components

Action Mediation Layer

Intercepts tool invocations and normalizes to canonical schema

Policy Engine

Evaluates actions and enforces decisions

Approval Service

Human-in-the-loop for high-risk actions

Receipt Generator

Cryptographically signed audit records

Data Flow

Intercept

Action Mediation Layer captures tool invocation from agent

Normalize

AML converts protocol-specific request to AARM action schema

Evaluate

Policy Decision Point matches action against rules

Enforce

Policy Enforcement Point implements decision (allow/deny/modify/step-up)

Approve

If STEP_UP, Approval Service routes to human approvers

Execute

If allowed, action forwards to tool

Record

Receipt Generator creates signed audit record

Export

Telemetry Exporter sends events to SIEM/SOAR

Component Responsibilities

Component	Input	Output	Required
Action Mediation	Protocol request	AARM Action	Yes
Policy Decision Point	Action	Decision	Yes
Policy Enforcement Point	Action + Decision	Enforced result	Yes
Approval Service	Action	Approval result	Yes
Receipt Generator	Action + Decision + Result	Signed receipt	Yes
Telemetry Exporter	Receipt	SIEM events	Recommended

Overview

System Components

Implementation Architectures

Threat Model

Conformance

Research Directions

Architecture

Components

Action Mediation Layer

Policy Engine

Approval Service

Receipt Generator

Data Flow

Component Responsibilities

Overview

System Components

Implementation Architectures

Threat Model

Conformance

Research Directions

​Architecture

​Components

Action Mediation Layer

Policy Engine

Approval Service

Receipt Generator

​Data Flow

​Component Responsibilities

Architecture

Components

Data Flow

Component Responsibilities