ARF AI

Control plane for autonomous AI.

ARF sits between an agent's intent and its execution. Every proposed action is evaluated against deterministic policy before anything happens, and the decision is recorded before the action runs — not after it succeeds.

🔒 ARF is commercial software and is not open source. The core engine, API control plane, gateway and enterprise extension are access-controlled. Access is through the sandbox, a pilot, or an enterprise agreement.

---

The problem

An agent that can restart a service, delete a volume, move money or approve a claim is not a chatbot. It is an operator without a review process.

The usual answer is to ask a model to check its own work. That produces a judgment which can differ between two identical requests — so it cannot be audited, cannot be appealed, and cannot be shown to anyone as a rule.

ARF's answer is that some decisions must not be delegated to judgment at all.

---

What ARF does

Every request returns one of three outcomes:

• ✅ APPROVE — within policy, and uncertainty is low enough to act.
• ⚠️ ESCALATE — the system could not establish that this is permitted. An input is missing, or the action is above the bar this policy clears alone.
• ❌ DENY — violates policy or exceeds risk tolerance.

ESCALATE is not a softer DENY. Collapsing the two destroys the difference between this is forbidden and this needs a person, and that difference is the whole of what a reviewer needs in order to act.

Every decision is:

• Deterministic where it matters — identical inputs, identical policy version, identical answer, every time.
• Explained — a refusal nobody can explain is not auditable, so a refusal without reasons is rejected rather than passed downstream.
• Recorded in a hash-chained audit log — each entry carries the hash of the entry before it, so modifying any past entry breaks every entry after it. Entries are additionally Ed25519-signed when a signing key is configured; without one they are still written and still chained, just unsigned. Chaining is integrity, not authorship — the two are not the same claim and we do not merge them.

Risk scoring is Bayesian and reports its own uncertainty, which is what drives escalation rather than a coin-flip at the threshold.

---

Who this is for

ARF is built first for teams where an agent can already change production state and nobody owns governance yet. A practical test:

• Can one of your agents take an action a customer would notice, without a human in the loop?
• If it did that wrongly at 3am, would you be able to show what was decided, by which rule, and on what inputs?
• Is there a named owner for that question today?

If the first two are yes and the third is no, that gap is what ARF closes.

Larger and regulated deployments are served too — through the enterprise tier, with SSO, multi-tenancy and an SLA — but the sandbox and pilot are designed for small teams shipping agents now.

---

Live demos

Both run on mock data. They demonstrate the decision surface; they do not enforce anything.

Mock responses only. Real enforcement requires sandbox or pilot access.

---

Public code

That repository is independent reference code. It is not ARF, it does not contain ARF's risk engine, authority system or execution-admission protocol, and it is useful whether or not you ever talk to us.

Everything else — core engine, API control plane, gateway, enterprise extension — is private and stays private.

---

Access

Pilot pricing is outcome-based: you pay for verified risk reduction, not per API call.

👉 Request pilot access → · arf-ai.com

When applying, include your organization, the use case, rough evaluation volume, and where it runs.

---

Design principles

1. Deterministic where the decision must be reviewable; probabilistic only where the world genuinely is uncertain.
2. A decision must be explainable to someone who was not there.
3. Uncertainty routes to a person; it never silently becomes approval.
4. The record is written before the action, not after it succeeds.
5. An unreachable dependency is not a permissive one — no control degrades quietly into no control.
6. Auditability is built in, not retrofitted.

---

Trust & compliance

ARF is architected for SOC 2 readiness and for review in regulated environments: tamper-evident audit trails, policy gates that cannot be silently bypassed, and explainable reasoning suitable for third-party audit.

To be precise about what that does and does not mean: this describes how the system is designed. It is not a certification, not an attestation, and nothing here establishes your compliance with any framework. ARF is also not a functional-safety layer — it governs decisions above certified safety systems and does not replace them.

---

Legal

• Core engine, API control plane, gateway, enterprise extension — proprietary. No public access.
• arf-pattern-examples — Apache-2.0, and genuinely so.
• This page and ARF marketing materials — © ARF Foundation. Not to be copied, redistributed, reverse engineered, or used for AI training without written permission.

---

© ARF Foundation. All rights reserved.