Every enterprise deploying AI agents will eventually face the same question: how do you prove what your agents did, why they were allowed to do it, and who approved it?
Today there's no standard answer. Compliance frameworks haven't caught up. Security tooling was built for humans clicking buttons, not agents executing hundreds of tool calls per minute. That's about to change.
We're partnering with AARM (Autonomous Action Runtime Management) to define the system category for AI agent runtime security. AARM is an open system category specification created by Herman Errico at Vanta, the company already shaping how thousands of enterprises think about compliance. With AARM, Herman is doing the same thing for agents: building the framework that will determine what "secure" and "compliant" mean when AI acts autonomously in production.
Runlayer has achieved AARM Extended Conformance (R1–R9), the highest tier in the specification. We're the only platform that meets the full requirements and extended requirements out of 40+ builders in the AARM ecosystem.
Why this partnership matters
AARM isn't a product. It's a system category specification that defines what a runtime security system must do: intercept agent actions before execution, evaluate them against policy, enforce authorization decisions, and produce cryptographically signed audit receipts. It's the foundation that compliance programs, procurement teams, and security reviews will build on as agent adoption scales.
Runlayer is built on the same principles. Our platform intercepts every tool call between AI clients and MCP servers, applies fine-grained policies before requests reach downstream systems, and produces tamper-evident logs for full session reconstruction. AARM Extended Conformance formalizes what we've shipped from day one across MCPs, Skills, Plugins, and Agents.
AARM specifies the need for a platform that operates at the enforcement point where agents take action. Runlayer fills this gap, with AARM validating our security architecture for enterprise buyers.
What comes next
This is the beginning of a broader effort. AARM will become a key benchmark enterprises use to evaluate agent security platforms, the same way SOC 2 became the benchmark for SaaS trust. We're excited to push forward on this partnership.
For our customers including Instacart, Gusto, dbt Labs, and Opendoor who are already running agents in production, AARM conformance means one thing: the security foundation under their AI transformation now has an open, verifiable standard behind it.
If you're deploying agents and need to answer the compliance question before it's asked, talk to us. Or read the full AARM specification and see where Runlayer stands.
