Documentation

Everything ARC Agent Governance checks, how it scores, and what it does with your data. If a finding surprised you, the rule behind it is on this page.

How the score is calculated

This is a governance posture score based only on the configuration you described. It measures whether controls are declared and coherent — not whether they are correctly implemented in your running systems. A high score is not a security assessment.

Each dimension starts at 100. Findings deduct a fixed penalty by severity: critical −30, high −18, medium −9, low −4, info −0. Dimension scores are combined as a weighted average. Bands: 80+ strong, 60–79 adequate, 40–59 at risk, below 40 critical.

Dimension	Weight	What it measures
Identity & Authentication	2	Starts at 100. Deducts where an agent has no distinct identity, shares credentials with a human or another agent, or authenticates with a long-lived static secret.
Least Privilege	3	Starts at 100. Deducts for each tool or scope granted beyond the agent's stated purpose, each wildcard permission, each write capability with no stated need, and each MCP surface without an allowlist or auth boundary.
Data Access	3	Starts at 100. Deducts for each data source reachable by the agent that is broader than its purpose, and where regulated or production customer data is in scope with no stated control.
Autonomy & Human Approval	2	Starts at 100. Deducts for each irreversible or externally visible action the agent can take with no human approval step.
Auditability	2	Starts at 100. Deducts where tool invocations, inputs, or decisions are not logged, where logs are not retained, and where there is no way to reconstruct why an agent acted.
Change Control	1	Starts at 100. Deducts where prompts, tools or permissions can change without review, versioning, or a rollback path.

What the score is not

Proof that your agents are secure
Verification that the described controls are actually in place
A compliance certification of any kind
A penetration test or runtime assessment

Rule catalog (v0.2.0)

19 deterministic rules. No network, no model, no randomness — the same input always produces the same findings. Rule ids are permanent; a rule whose meaning changes gets a new id.

identity

AG-IDENTITY-001govern
Agent uses a shared or human identity
Give each agent a distinct machine identity. Attribution is the foundation of every other control — without it, logs cannot answer who did what.
AG-IDENTITY-002secure
Long-lived static credential
Move to short-lived, automatically rotated credentials issued per session. If that is not possible today, at minimum set an expiry and an owner.
AG-IDENTITY-003govern
No distinct machine identity declared
Declare a workload identity (service principal, IAM role, or OIDC-bound identity) per agent and stop reusing human or shared logins.

privilege

AG-PRIVILEGE-001secure
Wildcard permission grant
Enumerate the specific operations the agent needs. A wildcard is not a permission decision; it is the absence of one.
AG-PRIVILEGE-002govern
Write capability with no stated need
Remove the grant, or document why the purpose requires it. Read-only is the correct default for an agent whose job is to analyze.
AG-PRIVILEGE-003govern
Tool grants exceed the agent's stated purpose
Reconcile the tool list against the purpose statement. Drop every capability that is not required for the described job.

data

AG-DATA-001secure
Agent can reach production customer data
Scope the data source to what the purpose requires, filter per requesting user where the agent acts on behalf of one, and document the decision.
AG-DATA-002secure
Data access broader than the stated purpose
Narrow to specific tables, indexes or document sets. Where the agent serves users, enforce the requesting user's own permissions at retrieval time.
AG-DATA-003secure
No user-scoped or tenant boundary on retrieval
Enforce tenant and user ACL checks at retrieval time. The model must not be the boundary.

autonomy

AG-AUTONOMY-001govern
Irreversible action with no human approval
Add an approval gate on the irreversible subset. The agent can prepare the action fully; a person confirms it. This preserves nearly all the speed benefit.
AG-AUTONOMY-002govern
No kill switch or emergency disable path
Add a kill switch: a named path to revoke credentials, disable tools, and halt the agent within minutes — tested, not theoretical.

audit

AG-AUDIT-001govern
Tool invocations are not logged durably
Log every tool invocation with agent identity, inputs (redacted), timestamp and outcome, to durable storage with a defined retention period.
AG-AUDIT-002govern
No stated retention for agent logs
Set retention against your realistic detection window, not your storage budget.
AG-AUDIT-003govern
No decision or reasoning trail
Retain a redacted decision trail (prompt version, tool args, outcome) long enough to investigate an incident.

change

AG-CHANGE-001govern
Prompts or permissions can change without review
Put prompts and tool manifests in version control and require review on change. An agent whose behavior cannot be reproduced cannot be governed.
AG-CHANGE-002govern
No evaluation before prompt or tool changes
Require a documented evaluation (golden cases or regression suite) before prompt or tool changes reach production.

mcp

AG-MCP-001secure
MCP tools exposed without an allowlist
Publish an explicit MCP tool allowlist. New tools must be reviewed before the agent can call them.
AG-MCP-002secure
MCP server reachable without authentication
Require authentication on every MCP endpoint and bind tokens to the agent identity that needs them.
AG-MCP-003govern
MCP mentioned without tool scope or trust boundary
Document which MCP servers are trusted, which tools are allowed, and what data each tool can reach before connecting them.

API

Everything the web UI does is available over HTTP. No key, no account. Please keep it to a few requests a minute — the rate limiter will tell you if you do not.

POST /api/assess
Content-Type: application/json

{
  "text": "your description here (40–40,000 characters)",
  "context": { "industry": "logistics" },
  "useModel": false
}

→ 200 AssessmentResult   (findings, evidence, score, recommendations, blueprint, limitations)
→ 400 { "error": "..." }   input failed validation
→ 429 { "error": "..." }   rate limited

GET /api/rules    the catalog above, as JSON
GET /api/health   { status, version, rulePackVersion, ruleCount }

Data policy

The text you submit is processed in the request and discarded when the response is sent. It is not written to a database, not used for training, and not sent to a model provider unless you explicitly opt in to the optional narrative pass. Errors are logged with the content redacted.

Email is collected only if you ask for a copy of a report. Assessment never requires it. The full policy is in docs/05-data-policy.md.

Everything else

The complete build package — product brief, PRD, architecture, threat model, evaluation plan, runbook — is in the repository. The roadmap is public and the issue tracker is open.