AARM action receipts: a VOLT and WARD mapping
Overview
AARM (Autonomous Action Runtime Management) is an open specification from the Cloud Security Alliance for securing AI-driven actions at runtime: systems that intercept, authorise and audit autonomous actions before they execute. It defines nine requirements in two conformance tiers, and it deliberately does not define how the records it demands are serialised. The specification mandates no policy language and no receipt format.
That is the gap this page addresses. Quox's protocols, AOCL for the control pipeline and VOLT plus WARD for the evidence, are concrete wire formats for the things AARM requires but leaves open. All four are live IETF Internet-Drafts (an Internet-Draft is a working document, not a standard). This page maps each AARM requirement to the protocol structure that carries it, and is explicit where Quox has no equivalent.
What AARM specifies, as of 31 August 2026
- Core requirements R1 to R6 (all MUST): pre-execution interception, context accumulation, policy evaluation with intent alignment, five authorisation decisions, tamper-evident action receipts, cryptographic identity binding.
- Extended requirements R7 to R9 (SHOULD): semantic distance tracking, telemetry export, execution-time least privilege.
- No wire format. The specification defines what must be recorded, not how to serialise it. Hash chaining appears only as a SHOULD for the session context store.
- Governance: authored at Vanta, contributed to the CSAI Foundation in April 2026, now owned by a CSA technical working group. Version 1.0 published February 2026; a v2.0 is planned. Licence CC BY 4.0.
The R1 to R9 mapping
| Req | AARM requires | How Quox structures carry it | Where |
|---|---|---|---|
| R1 Core Pre-execution interception | The system intercepts every agent-initiated action before it executes. | AOCL L3 policy.gate holds every action envelope before L7 delegate.execute runs it. Nothing reaches a tool without passing the gate. | AOCL layers L3, L7 |
| R2 Core Context accumulation | Decisions are made against accumulated session and environment context. | AOCL L5 context.retrieve feeds the gate; the retrieval itself is emitted as an auditable event. | AOCL layer L5 |
| R3 Core Policy evaluation | Actions are evaluated against policy, including intent alignment. | aocl.policy.evaluated events record the policy ID, the result and the reason for every evaluation. | AOCL L3; VOLT event aocl.policy.evaluated |
| R4 Core Authorisation decisions | Five decision outcomes: ALLOW, DENY, MODIFY, STEP_UP, DEFER. | AOCL gates resolve to ALLOW, DENY or HOLD. HOLD covers the STEP_UP and DEFER cases by routing to human approval; MODIFY has no direct AOCL equivalent today. | AOCL L3; honest gap noted below |
| R5 Core Tamper-evident receipts | A tamper-evident action receipt is produced for every evaluated action. | Every VOLT event is SHA-256 hash-chained to its predecessor; runs export as portable Evidence Bundles anyone can verify offline. WARD witnesses the chain content-free, so tampering is detectable even if the producing host is compromised. | VOLT event hash chain; WARD witness chain |
| R6 Core Identity binding | Every action receipt is cryptographically bound to an agent identity. | Every VOLT event carries a required actor object (actor_type, actor_id); bundles support Ed25519 signatures, and WARD tips are Ed25519-signed and published to external sinks. | VOLT actor field and signatures; WARD signed tips |
| R7 Extended Semantic distance tracking | Intent drift is tracked across a session. | No equivalent. Quox does not measure semantic drift; the protocols record what happened rather than scoring intent. | Not covered |
| R8 Extended Telemetry export | Decision telemetry is exportable. | VOLT Evidence Bundles are the export: manifest, ordered events and attachments, portable and independently verifiable. | VOLT Evidence Bundles |
| R9 Extended Execution-time least privilege | Actions execute with minimal privilege. | Partially adjacent: Quox scopes credentials to tools at execution time, but that is platform behaviour, not something the protocols specify. | Platform, not protocol |
The honest gaps, stated rather than buried: R4's MODIFY outcome has no direct AOCL equivalent, R7 semantic drift tracking has no Quox equivalent at all, and R9 least privilege is platform behaviour rather than protocol structure. A mapping that claimed nine for nine would not deserve your trust.
A worked action receipt
AARM's R5 and R6 demand a tamper-evident receipt, cryptographically bound to an identity, for every evaluated action. Below is what that looks like as VOLT events, taken from the specification's worked example: the policy evaluation and the execution it authorised, each carrying a required actor, each hash-chained to its predecessor.
Any modification anywhere in the chain breaks verification, and the run exports as a portable Evidence Bundle a third party can verify offline with no Quox software or account.
{"volt_version":"0.1","event_id":"E3","run_id":"RUN1",
"ts":"2026-02-28T19:00:00.020Z","seq":3,
"event_type":"aocl.policy.evaluated",
"actor":{"actor_type":"system","actor_id":"quox.aocl"},
"context":{"correlation_id":"corr-001",
"aocl_policy_id":"policy.ops.readonly","aocl_decision_id":"dec-001"},
"payload":{"result":"allow","reason":"read_only_check"},
"prev_hash":"<hash2>","hash":"<hash3>"}
{"volt_version":"0.1","event_id":"E6","run_id":"RUN1",
"ts":"2026-02-28T19:00:00.180Z","seq":6,
"event_type":"tool.call.executed",
"actor":{"actor_type":"runner","actor_id":"runner:vm-ops-01"},
"context":{"correlation_id":"corr-001"},
"payload":{"tool_name":"shell","status":"success","duration_ms":150},
"prev_hash":"<hash5>","hash":"<hash6>"}WARD then witnesses the chain content-free: source ID and hash only, with Ed25519-signed tips published to external stores, so a rewrite is detectable even if the host that produced the evidence is compromised. That property is beyond what AARM asks for, and it is the part an operator cannot retrofit later.
What this page is not
Quox does not claim AARM conformance. AARM's verified conformance requires working-group membership, five or more active production customers for three months, and a SOC 2 Type II, ISO 27001 or FedRAMP certification. Quox does not currently meet that gate and will not imply otherwise.
This page claims exactly one thing: that VOLT and WARD are concrete, publicly specified, independently implementable encodings for the receipt AARM requires and declines to define. Check the mapping yourself against both sets of documents; they are all public.
Where AARM ends and Quox continues
AARM's boundary is the action: intercept it, decide it, receipt it. That is one slice of operating agents accountably. The full lifecycle runs from the message that requested the action, through identity, routing, policy, planning and context, to execution, verification, evidence and independent witnessing. AARM's published direction for v2.0 includes multi-agent coordination and long-horizon task governance, which is ground the Quox protocols already specify today.
- AARM secures an action.
- AOCL governs the operation.
- AEE connects the actors.
- VOLT proves what happened.
- WARD proves the proof was not rewritten afterwards.
Sources
- AARM specification and conformance requirements (aarm.dev)
- CSA AARM working group
- The AARM paper (arXiv 2602.09433)
- Quox drafts on the IETF datatracker: draft-cowles-aocl, draft-cowles-volt, draft-cowles-ward
- Specifications with schemas and worked examples: github.com/quoxai/volt, github.com/quoxai/ward
AARM facts on this page were verified against the sources above on 31 August 2026. If the AARM specification has moved since, trust it over this page and tell us.