NOCTRYSLeast privilege, enforced deterministically.
Every action is checked against an explicit policy before it runs. There is no AI model in the enforcement path, so the verdict is reproducible, auditable, and immune to a clever prompt.
Policy is a manifest
You describe what an agent is allowed to do in a small, human-readable policy manifest. NOCTRYS enforces it on every action, in order, and fails closed if anything is unexpected.
{
"agentId": "billing-agent",
"allowedTools": ["db.read", "payments.transfer", "email.send"],
"spendCap": 5000,
"rateLimit": { "max": 20, "windowMs": 10000 },
"egress": { "email.send": { "field": "to", "allow": ["*@acme.com"] } },
"approval": { "tools": ["payments.transfer"], "approvers": { "cfo": "" } },
"mandate": { "tools": ["payments.transfer"] },
"maxDelegationDepth": 2,
"protectedSurfaces": ["agents/billing-agent/manifest", "secrets/"]
} The controls, and what each stops
| Control | What it stops |
|---|---|
Allowlist (+ ns.* wildcards) | An agent using a tool it was never granted. |
| Argument schema | Unexpected, oversized, or smuggled arguments. |
| Output schema | A tool returning malformed or oversized data back into the model. |
| Spend caps & rate limits | Runaway cost and abnormal action volume, per agent. |
| Signed human approval | A high-risk action running without a named human’s cryptographic sign-off, bound to that exact action. |
| Signed payment mandates (AP2) | Money moving without a valid signed consent chain recording who authorized it, to whom, and how much. |
| Egress control | Sending to a destination outside the allowlist (deterministic DLP). |
| Path & sequence policies | Dangerous orderings of individually allowed actions. |
| Delegation governance | Over-deep, cyclic, or privilege-escalating agent-to-agent delegation. |
| Content-usage (AIPREF) | Using content for an AI purpose a publisher opted out of. |
| Self-modification block | An agent widening its own permissions or editing its own policy. |
| Canary tripwires | A compromise, revealed the instant an agent touches a decoy tool or token. |
Why deterministic matters
Guardrails built from a second model are probabilistic: they are right most of the time, which means they are wrong some of the time, and an attacker only needs once. NOCTRYS verdicts are computed by explicit rules: the same action always yields the same decision, every decision is explainable, and the system fails closed. That is what an auditor, a regulator, and your own incident-response team can actually rely on.
Be one of our first five design partners
Free pilot. A two-week, self-hosted integration. You keep the tamper-evident audit and the AI Act compliance report.
Request a pilot →