If you accept that agents will be wrong some meaningful fraction of the time, governance stops being a filter and becomes a decision procedure. Something has to look at each consequential action, weigh everything that is known about it, and pick a response proportionate to the risk. This post walks through how ARC does that.
Seven questions about the same action
A single agent action can raise several unrelated concerns at once. ARC groups rails into seven disciplines, each answering a different question:
| Discipline | Question | Default posture |
|---|---|---|
| safety | Can this action harm a person or the physical world? | fail closed |
| reliability | Does the system do what it claims, repeatably? | fail open, raise an alarm |
| security | Is someone making the agent act against its owner? | fail closed |
| compliance | Can we show a regulator this was controlled? | fail closed on evidence loss |
| governance | Who authorised this behaviour, under which version? | fail closed |
| risk | How much exposure are we carrying right now? | fail open, escalate |
| hazop | Which deviations from design intent have we analysed? | advisory; gates release |
These are not layers. A refund issued right after a customer email arrives can trip a safety budget, a security sequence rail and a compliance provenance rail in the same request. The verdict algebra is what reconciles them.
From a measure to a verdict
For scalar measures ARC keeps the semantics the original Airbender platform earned in production, ported verbatim. A rail has two thresholds and an optional pair of hard caps. A value is classified into a band: good, warning or risk. A value outside a hard cap is always risk. A missing threshold yields no band at all, never a default.
The band and two flags on the rail then resolve to a severity and a block decision:
| Rail flags | Band | Severity | Blocks? |
|---|---|---|---|
| critical | risk | critical | always |
| critical | warning | high | no |
| not critical | risk | high | if the rail is auto-block |
| not critical | warning | medium | no |
Every boundary in that matrix is a decision someone already argued through, which is why we ported it rather than improved it. A blocking verdict applies the rung the rail declares. A non-blocking one can at most annotate.
Composition: the strictest rail wins
When several rails trip on one action, the effective severity is the maximum by rank and the effective rung is the highest any tripped rail demands. A pass never softens a refusal. In our demo scenario, a $1,300 refund after an approved $800 one trips two rails at once:
| Rail | Band | Severity | Applied |
|---|---|---|---|
refund_budget_per_session | risk | critical | R2 |
refund_needs_human_above_500 | risk | critical | R2 |
refund_requires_order_lookup | good | none | R0 |
An approver can grant the gate, and the retry verifies the approval's scope, role and age. The budget still refuses, because the session total would be $2,100 against a $2,000 ceiling. The approval answers one rail, not all of them.
Posture: what happens when ARC can't decide
The hard cases aren't breaches. They are the moments when a rail can't be evaluated at all: a detector times out, a measure never arrives, a configuration won't resolve. Most governance tools fail open here without saying so. ARC makes it a declared property of each discipline, the posture:
- Fail closed: non-evaluation is treated as risk. A security detector that misses its 250 millisecond deadline refuses the call and writes an unevaluated event.
- Fail open with an alarm: the request proceeds, an unevaluated event is written, and a reliability alarm is raised against the platform itself.
- Advisory: recorded, never blocking.
A bundle can override postures per discipline, so a team that needs strict reliability rails gets them without touching the platform. The decision is in the diff, where reviewers can see it.
Shadow first, then enforce
Any rail can be released at R0 in shadow mode. It evaluates on real traffic and records the rung it would have applied next to the rung it did apply. That pair is exactly what a shadow report needs. When the false-positive rate is acceptable, a new bundle version raises the rung. Nobody has to guess what a new rail will do to production.
One kernel, no I/O
All of this lives in one place, a pure decision kernel with no network calls, no clock and no state. It is the reason a verdict can be replayed months later and give the same answer. Everything else in ARC is transport, storage or presentation. When you read a rail's verdict in the console, you're reading the output of a function you can run yourself.