Architecture

You do not need this page to use the product. It is here for the person who has to approve it.

The shape of it

The guardrail decides and records. The console never decides. That split is what lets the console promise it is showing real evidence: it has no way to compute a decision, so it can only render one that was already made and stored. The console does write, but only the inputs and the account around them, such as policy drafts, published versions, API keys and billing. No evidence it displays is ever produced by it.

The parts

The plugin on your machine. ArmorClaude for Claude Code, ArmorCodex for Codex. It sees the tool calls your assistant attempts, applies the published policy profile, and reports what happened. Installed with one command; see Quickstart.

The SDK. TypeScript and Python. Carries device identity and the enforcement and telemetry calls. The plugins depend on it, so a plugin cannot quietly fail to report.

The backend. Receives policy checks and telemetry, stores sessions and tool evidence, and serves the console. Policy evaluation runs through a dedicated engine and fails closed: when evaluation fails, the call is denied rather than allowed.

The console. A static single-page app at tools.armoriq.ai, served over HTTPS with framing disabled and a no-referrer policy. It runs no server of its own and reads the backend over authenticated requests. It does keep state in your browser: your session tokens, the selected workspace, your theme, and your prompt library all live in browser storage.

What this means for a review

• Source code is not transmitted. The plugin reports tool names, timings, decisions, token counts, and session and device identifiers.
• Machine credentials are scoped and local. The install writes one ingestion-scoped key to ~/.armoriq/credentials.json with owner-only permissions, and only after you approve a short code shown in the browser.
• Enforcement fails closed. A failed policy evaluation denies.
• The reporting path is auditable. Ingest health is exposed in the product, so a silent reporting failure is visible rather than indistinguishable from low activity.
• Revocation is self-serve. Revoking a device key in the console is a two-click action and cuts off that machine's access.

For what is not yet built, including the absence of team roles and approval workflows, see Limits.