AARM Mapping

A self-assessed mapping of Mergen against the specification's requirements, with every gap stated.

CSA AARM Conformance Mapping

The Autonomous Action Runtime Management (AARM) is an open specification published by the Cloud Security Alliance (CSA) that formalizes security requirements for agent gateways. This is Mergen's own mapping against it, not a third-party certification. Mergen meets mandatory requirements R2 to R5 and recommended guideline R6. R1 (pre-execution interception) is met on every surface that offers a pre-execution hook, and not on Cursor and VS Code file edits, where Mergen can only detect and revert. R7 (semantic distance tracking) is partially addressed through behavioral sequence matching. Both gaps are spelled out below.

Pre-Execution Interception

● Partial

AARM Requirement:

The system MUST intercept every tool invocation before the handler executes. No tool call may reach its execution environment without passing through the evaluation gate.

Mergen Implementation:

tool-guard.ts: applyGate() runs before the handler on every surface that offers a pre-execution hook, and a blocked call never reaches its execution environment. Pre-execution today: Claude Code (PreToolUse, Bash and Edit/Write/MultiEdit), Windsurf (pre_write_code / pre_run_command), Cursor shell commands (beforeShellExecution), Codex CLI (PreToolUse for Bash and apply_patch, once the user trusts the hook in Codex; not yet verified in a live session), and CLI-wrapped commands, including in a CI runner. Not pre-execution: Cursor and plain VS Code file edits, which neither platform lets a hook stop before the write. Mergen detects and reverts those right after they land, which is post-write remediation, not interception. That gap is why R1 is Partial rather than Conformant.

Context Accumulation

● Conformant

AARM Requirement:

The system MUST maintain session-scoped state that accumulates prior tool call history and uses it to inform subsequent evaluation decisions.

Mergen Implementation:

session-threat-tracker.ts: Maintains a 20-call rolling ring buffer per session. Tracks context to detect multi-turn threat sequences and contamination drift.

Policy + Intent Alignment

● Conformant

AARM Requirement:

The system MUST evaluate tool calls against explicit, operator-defined policy rules. Rules MUST be deterministic: the same input must always produce the same verdict without reliance on probabilistic models.

Mergen Implementation:

enterprise-policy-engine.ts: Evaluates rules against DEFAULT_ENTERPRISE_POLICY JSON definitions. Enforces a strict deterministic property (<1ms execution, no LLM in gate path).

Five Authorization Decisions

● Conformant

AARM Requirement:

The system MUST support at least five authorization verdicts: ALLOW, DENY, MODIFY, STEP_UP, and DEFER.

Mergen Implementation:

PASS (ALLOW), BLOCK (DENY), Slack HITL approvals (STEP_UP), and the async operator queue (DEFER) map directly. MODIFY maps via guided alternatives: a BLOCK returns a structured "what to do instead" that the agent adopts on its retry; Mergen never silently rewrites a call in flight, by design.

Tamper-Evident Receipts

● Conformant

AARM Requirement:

Every authorization decision MUST be recorded in a tamper-evident audit log. The log MUST be verifiable: any modification to a prior entry MUST be detectable.

Mergen Implementation:

action-ledger.ts: every gate decision (PASS, HOLD and BLOCK) is appended to a local, per-workspace ledger whose rows are SHA-256 hash-chained (hash-chain.ts), with retention pruning re-anchoring the chain rather than breaking it. Blocks are additionally kept in a hash-chained blunder log. `mergen-server audit verify` recomputes every chain and reports any modified, removed or reordered entry.

MCP Gateway Pattern (SHOULD)

● Conformant

AARM Requirement:

The system SHOULD operate as a transparent proxy that requires no code changes in the guarded agent or its IDE.

Mergen Implementation:

mergen-server setup: Installs each IDE's own native pre-write/pre-run hook automatically, routing every covered call through Mergen without modifying agent code or tools.

Semantic Distance Tracking (SHOULD)

● Partial

AARM Requirement:

The system SHOULD track semantic distance between a session's declared intent and observed tool call patterns, escalating to STEP_UP when drift is detected.

Mergen Implementation:

Partially addressed: session-threat-tracker.ts maintains a per-session rolling window and escalates known multi-turn attack sequences and post-injection contamination to HOLD (STEP_UP). Explicit declared-intent capture and semantic-distance scoring against it are not implemented; behavioral sequence matching is the mechanism today.

// VERIFY CONFORMANCE LOCALLY

# Verify R5: recompute every audit chain (exit 1 on a broken one)
mergen-server audit verify

# Verify R3: same input, same verdict, decided locally
mergen policy test-action "terraform destroy -auto-approve"

# Verify R1 on this machine: which surfaces are gated, and how
mergen-server doctor