Conformance
Conformance Requirements
Two levels: AARM Core (R1–R6, all MUST) for baseline conformance and AARM Extended (R1–R9) for mature implementations.
All six requirements are MUST. Baseline for AARM conformance.
Core + three SHOULD requirements for advanced governance.
Core Requirements — MUST
R1MUSTThe system MUST intercept every agent-initiated action before it is executed. No action may bypass the control plane.
R2MUSTThe system MUST accumulate and maintain context about the agent's intent, prior actions, and the conversation or task thread.
R3MUSTThe system MUST evaluate each action against a policy that considers both the action itself and its alignment with the stated agent intent.
R4MUSTThe policy engine MUST be capable of producing one of five decisions: ALLOW, DENY, MODIFY, STEP_UP, or DEFER.
R5MUSTThe system MUST produce a tamper-evident receipt for every evaluated action, including the decision, timestamp, and relevant context.
R6MUSTEvery action receipt MUST be cryptographically bound to an agent identity.
Extended Requirements — SHOULD
R7SHOULDThe system SHOULD track semantic distance between proposed actions and the original stated intent, flagging drift over long task horizons.
R8SHOULDThe system SHOULD export action telemetry in a standard format (e.g. OpenTelemetry) for integration with SIEM and observability platforms.
R9SHOULDThe system SHOULD enforce least-privilege scoping of agent credentials and tool access at the time of action execution.
How to claim conformance
01Satisfy all MUST requirements (R1–R6) for Core, or R1–R9 for Extended.02Complete the testing protocol and compile evidence for each requirement.03Engage with the working group community before submitting.04Operate the system in a production environment with real agent workloads.05Submit your evidence package and wait up to 14 days for the conformance report.