ML Security PapersAutonomous Action Runtime Management(AARM):A System Specification for Securing AI-Driven Actions at Runtime
Published on arXiv
2602.09433
Excessive Agency
OWASP LLM Top 10 — LLM08
Insecure Plugin Design
OWASP LLM Top 10 — LLM07
Key Finding
AARM establishes action execution as a stable, model-agnostic security boundary, enabling interception and contextual authorization of AI-driven tool calls to defend against prompt injection, confused deputy attacks, and intent drift before they produce irreversible consequences.
AARM (Autonomous Action Runtime Management)
Novel technique introduced
As artificial intelligence systems evolve from passive assistants into autonomous agents capable of executing consequential actions, the security boundary shifts from model outputs to tool execution. Traditional security paradigms - log aggregation, perimeter defense, and post-hoc forensics - cannot protect systems where AI-driven actions are irreversible, execute at machine speed, and originate from potentially compromised orchestration layers. This paper introduces Autonomous Action Runtime Management (AARM), an open specification for securing AI-driven actions at runtime. AARM defines a runtime security system that intercepts actions before execution, accumulates session context, evaluates against policy and intent alignment, enforces authorization decisions, and records tamper-evident receipts for forensic reconstruction. We formalize a threat model addressing prompt injection, confused deputy attacks, data exfiltration, and intent drift. We introduce an action classification framework distinguishing forbidden, context-dependent deny, and context-dependent allow actions. We propose four implementation architectures - protocol gateway, SDK instrumentation, kernel eBPF, and vendor integration - with distinct trust properties, and specify minimum conformance requirements for AARM-compliant systems. AARM is model-agnostic, framework-agnostic, and vendor-neutral, treating action execution as the stable security boundary. This specification aims to establish industry-wide requirements before proprietary fragmentation forecloses interoperability.
Key Contributions
- AARM specification: a runtime security system that intercepts AI agent actions before execution, accumulates session context, and enforces policy-based authorization with tamper-evident audit receipts
- Action classification framework distinguishing forbidden, context-dependent-deny, context-dependent-allow, and defer actions, handling cases where available context is insufficient for a conclusive decision
- Four implementation architectures (protocol gateway, SDK instrumentation, kernel eBPF, vendor integration) with distinct trust properties, plus minimum conformance requirements for interoperable AARM-compliant systems