AARM Conformance
How Mergen implements the five mandatory requirements of the Cloud Security Alliance standard.
CSA AARM Conformance Mapping
The Autonomous Action Runtime Management (AARM) is an open specification published by the Cloud Security Alliance (CSA) that formalizes security requirements for agent gateways. Mergen satisfies all 5 mandatory requirements (R1–R5) and recommended guideline R6; R7 (semantic distance tracking) is partially addressed via behavioral sequence matching, disclosed as such below.
Pre-Execution Interception
The system MUST intercept every tool invocation before the handler executes. No tool call may reach its execution environment without passing through the evaluation gate.
tool-guard.ts: Wraps every MCP tools/call request. Enforces check prior to downstream tool invocation. If blocked, downstream execution is completely prevented.
Context Accumulation
The system MUST maintain session-scoped state that accumulates prior tool call history and uses it to inform subsequent evaluation decisions.
session-threat-tracker.ts: Maintains a 20-call rolling ring buffer per session. Tracks context to detect multi-turn threat sequences and contamination drift.
Policy + Intent Alignment
The system MUST evaluate tool calls against explicit, operator-defined policy rules. Rules MUST be deterministic — the same input must always produce the same verdict without reliance on probabilistic models.
enterprise-policy-engine.ts: Evaluates rules against DEFAULT_ENTERPRISE_POLICY JSON definitions. Enforces a strict deterministic property (<1ms execution, no LLM in gate path).
Five Authorization Decisions
The system MUST support at least five authorization verdicts: ALLOW, DENY, MODIFY, STEP_UP, and DEFER.
PASS (ALLOW), BLOCK (DENY), Slack HITL approvals (STEP_UP), and the async operator queue (DEFER) map directly. MODIFY maps via guided alternatives: a BLOCK returns a structured "what to do instead" that the agent adopts on its retry — Mergen never silently rewrites a call in flight, by design.
Tamper-Evident Receipts
Every authorization decision MUST be recorded in a tamper-evident audit log. The log MUST be verifiable — any modification to a prior entry MUST be detectable.
agent-blunder-store.ts: Writes blocks to a local, append-only, SHA-256 hash-chained JSON log file. Includes command validation CLI command to verify chain integrity.
MCP Gateway Pattern (SHOULD)
The system SHOULD operate as a transparent proxy that requires no code changes in the guarded agent or its IDE.
mergen-server setup: Modifies client settings to automatically proxy agent communication without modifying client code or tools.
Semantic Distance Tracking (SHOULD)
The system SHOULD track semantic distance between a session's declared intent and observed tool call patterns, escalating to STEP_UP when drift is detected.
Partially addressed: session-threat-tracker.ts maintains a per-session rolling window and escalates known multi-turn attack sequences and post-injection contamination to HOLD (STEP_UP). Explicit declared-intent capture and semantic-distance scoring against it are not implemented — behavioral sequence matching is the mechanism today.
// VERIFY CONFORMANCE LOCALLY
# Verify R5: Check blunder log chain integrity mergen-server verify-log # Verify R3: Execute local regression test harness cd server && npm run test # View full documentation See docs/AARM_CONFORMANCE.md in the Mergen repository