StructureClerk claims no AARM conformance level.
AARM (Autonomous Action Runtime Management) is an open specification for the runtime security of AI agents, published on arXiv in February 2026 and contributed to the Cloud Security Alliance, where it is now a Technical Working Group.
An AARM system intercepts actions before execution, evaluates them against policy and contextual intent, applies an authorization decision, and records tamper-evident receipts binding action, context and outcome.
That is the category StructureClerk belongs to. This page maps the nine requirements one by one, and the ones that are not met are shown exactly like the ones that are.
| Requirement | Level | Status | What StructureClerk does |
|---|---|---|---|
| R1Pre-execution interception | CoreMUST | Not met | The engine is advisory. It returns a decision; it does not sit in the execution path and it blocks nothing. That is a design choice, explained below. |
| R2Context accumulation | CoreMUST | Partial | Context is evaluated per request: jurisdictions, sector, destination, declared regulator registrations, organisation profile. Nothing accumulates from one action to the next, because the decision function is pure and holds no state. |
| R3Policy evaluation with intent alignment | CoreMUST | Partial | Policy evaluation is there: a versioned rule table, a second jurisdictional pass that can only tighten a decision, and a doubt threshold that escalates when confidence is low. Intent alignment is not. |
| R4Five authorization decisions | CoreMUST | Partial | Four of the five. The engine returns ALLOW, APPROVE, DENY and ESCALATE. MODIFY does not exist. |
| R5Tamper-evident receipts | CoreMUST | Met | A SHA-256 fingerprint of the request and decision together, an Ed25519 signature, hash chaining, RFC 3161 anchors, and public verification that is free and needs no account. Locked by tests/authority-engine.test.mts |
| R6Identity binding | CoreMUST | Partial | The agent identifier supplied by the caller is bound into the signed hash, so the decision commits to it. StructureClerk does not verify that the identifier belongs to the agent presenting it: it attests to what it was shown. Binding is not authentication. |
| R7Semantic distance tracking | ExtendedSHOULD | Not met | No notion of semantic distance. |
| R8Telemetry export (OpenTelemetry) | ExtendedSHOULD | Not met | No OpenTelemetry export in the sources. |
| R9Least-privilege enforcement | ExtendedSHOULD | Not met | Least-privilege enforcement presupposes an enforcement point. There is none. |
Requirement states derived on September 19, 2026.
StructureClerk is a decision point, not an enforcement point. Enforcement belongs to the infrastructure that runs the agent: StructureClerk decides, your infrastructure applies. Building enforcement into the service would contradict the product thesis, so R1 is not a gap waiting on implementation. The way to satisfy it without contradiction is a reference enforcement point that runs in your own infrastructure and calls the decision API before each tool call. That work is planned and is not shipped.
No listing date is promised. Submission is only possible once the work above is done, and review takes as long as it takes.
The requirement titles and levels in the first two columns come from the working note that opened this project, not from a reading of the published normative text: the environment that produced this page has no outbound network access to aarm.dev or to arXiv. The last column, what StructureClerk does, is derived from this repository and locked by tests. Read the specification at the links below before relying on the first two columns.