Loading…
For companies whose AI agents touch money, data or production
No protected action runs without a valid approval.
Noa cannot stop an action that never reaches it.
Read the four required rulesNOA Mandate has one way of use: all four rules. There is no partial mode. The vault lock checks the approval where the action happens. Today: the Gate is an open-source reference (prototype); the vault lock (vault guard) is being built. Pilots start after the vault lock’s core parts are built and checked by someone other than its builders. The free console beta is open for testing.
safe → auto-allow risky → your approval forbidden → blocked
example receipt · denied refund
Phone approval through the relay — our message service that carries approval requests to the phone — was last proven for our own workspace on 29 September 2026. The app is coming to the App Store and Google Play; neither store offers it yet.
Coming to the App Store and Google Play; neither store offers it yet
What NOA Mandate is
Your company’s AI agents can act on money, data and production systems.
Noa guards the vault: the system that makes the change checks the approvalbefore it acts.
The same four rules apply whether an AI agent, a script or a person asks. The Gate — the program that holds an action, asks for approval and issues a one-time grant — is an open-source reference (prototype); the vault lock (vault guard) is being built.
The short version
Four questions, four plain answers.
What is free?
NOA Mandate Core is free open-source software under Apache-2.0, a license that lets you use and inspect the code. It contains the receipt format, verifier and door-guard building blocks.
What is hosted?
NOA Mandate Enterprise Console is the hosted workspace for rules, approvals and records. Signup is open. It is free during beta, a testing stage without a service-level agreement (SLA).
What is the commercial product?
NOA Mandate Enterprise is the commercial offering. Paid plans may follow with advance notice. The supported vault lock is being built; customer pilots start after the vault lock’s core parts are built and checked by someone other than its builders.
What can I inspect?
The core source and receipt verifier are public. The hosted console and phone app are private. A receipt is a signed record of a decision or reported result; it does not prove a payment settled or a physical event happened.
The problem
AI agents are starting to do things — pay, refund, email, delete, deploy. And AI makes mistakes.
A wrong payment or deletion can be hard to reverse. Approval must be checked before the change.
After-the-fact
A log records a report.
A record written after an action cannot, by itself, stop that action.
Before it runs
Noa decides what should happen — before it runs.
The vault lock refuses a protected action without a valid approval. All four no-back-door rules are required. Today’s Gate is a reference prototype using a test ledger; the supported vault lock is being built.
How it works
Ask. Check. Keep the receipt.
- 01
Agent proposes an action
An agent asks to refund a payment, delete data or deploy code. A door guard checks the request; the vault lock must check the approval where the change is made.
agent → propose( payment.refund ) - 02
Noa checks your rules
The door guard allows calls your rules permit, holds calls needing approval, and blocks forbidden calls. A protected action still needs a valid approval at the vault.
auto-allow safeapprove riskyblock forbidden - 03
Keep a receipt you can check
A signed receipt records the request, the decision and what the vault reported, including an uncertain result. It does not prove a real-world outcome. The reference Gate demonstrates this record; the supported vault lock is being built.
receipt rcpt_… · hash sha256:… · prevHash ↩
Receipts link to earlier receipts using hashes — short fingerprints of their contents. Keep a trusted checkpoint, a saved chain head, to detect a missing tail too.
The demo
A hallucinating agent tries to refund $1,000,000.
Illustration: the agent invents a $1,000,000 refund. Noa holds it. The approver denies it on their own paired phone. The vault never runs it, and the receipt records the denial.
agent.tsillustrated flow
This is an example, not a live payment. The door guard’s proxy (a tool-call bridge) and SDK (a software library) are on npm, the JavaScript package registry. The Gate — the program that holds an action, asks for approval and issues a one-time grant — is an open-source reference (prototype); the vault lock (vault guard) is being built.
Phone approval through the relay was last proven for our own workspace on 29 September 2026; the app is not publicly downloadable yet. Check a receipt with: npx noa-receipt verify .
noa · illustrated denial
held → denied → never executed
noa · forbidden action
blocked — never ran
verify it yourself
$ npx noa-receipt verify receipt.json --keyring keys.json
Example result: VALID with matching trusted keys and a valid chain
Also inspect the published package artifact: npm pack noa-receipt@0.9.0 && tar xzf noa-receipt-0.9.0.tgz && node package/dist/src/cli.js verify …
Offline means without a network connection. No Noa account is needed. The verifier checks signatures and each prevHash link to the previous receipt. A valid record does not prove the reported action happened.
Or verify a chain right now, in your browserWhy open source
A trust layer you have to blindly trust isn't a trust layer.
NOA Mandate Core’s policy rules and receipt format are open source under Apache-2.0. The hosted console and phone app are private. Offline. No Noa account required.
$npx noa-receipt verify receipt.json --keyring keys.jsonExample result (summarised from the JSON output): status VALID; signatures checked; newest receipts not checked without a checkpoint
What a receipt proves
A pass has to be earned.
The verifier checks the evidence you supply. It does not decide whether a signed statement is true or whether a physical event happened.
A keyring is a list of trusted public keys. Without one, signature checks are UNVERIFIED. Without a trusted checkpoint, removing the newest receipts cannot be detected offline.
$npx noa-receipt verify receipts.jsonExample result (summarised from the JSON output): status UNVERIFIED; signatures not authenticated (no keyring)
Keep the receipts, trusted public keys and checkpoints. A receipt signed by a later-retired key also needs the key’s validity record and the required trusted checkpoint; retirement must not silently become a pass.
For the skeptics
Overhead
The local door guard uses an in-memory comparison — a check inside the running program, with no network round-trip for that check. Calls needing approval wait. This is not a speed claim for the whole system.
Fail-mode
No decision means no protected action. This is called fail-closed. The four-rule product has no partial mode.
What receipts store
Receipts store parameter hashes, not raw parameter values. A hash is a fingerprint, not encryption: a guessable value can still be guessed. Approvers appear as internal identifiers.
FAQ
Straight answers, including the uncomfortable ones.
The local door guard uses an in-memory comparison: it checks rules inside the running program. Calls needing approval wait. Hosted checks also read workspace rules, so this is not a promise about end-to-end latency — the total time from request to result.
For developers
Build with the open-source core.
Live on npm today: noa-receipt 0.9.0 (receipt verifier), noa-mcp-proxy 0.5.0 (door guard for Model Context Protocol tool calls), and noa-mcp-adapter-core 0.5.0 (JavaScript/TypeScript software library). These building blocks alone do not provide the four-rule guarantee.
MCP proxyzero-code · live on npm
Connect any MCP host through this proxy to its tool server. The proxy checks the tool calls sent through it; the vault lock is a separate requirement. This example passes no --policy, so it runs the built-in demo policy written for the bundled demo server, with a warning at every start.
Install and use guide →$ npx noa-mcp-proxy -- node your-server.mjs
→ every tools/call gated: ALLOW → forwarded + receipted
DENY → blocked + receiptedpreCheckSession()one function call · live on npm
Add a check before a tool call in a JavaScript/TypeScript executor. The executor must act on the decision. For other hosts, use the MCP proxy; MCP means Model Context Protocol, the tool-call interface.
$ npm install noa-mcp-adapter-core
const { decision, receipt } = preCheckSession(toolCall, opts);
if (decision === 'ALLOW') await run(toolCall);
// receipt is signed + hash-chained either wayNoa Receiptopen spec
JSON is a text format for structured data. NOA receipts use it to record decisions and parameter hashes. The schema checks the shape; verification checks signatures and links.
{
"spec": "noa.receipt/0.1",
"governance": { "verdict": "EXECUTED" },
"chain": { "seq": 42, "hash": "sha256:…" }
}npx noa-receipt verifyverify · live on npm
Recompute every hash, check each prevHash link. Offline, no service.
$ npx noa-receipt verify receipts.json --keyring keys.json
Example result (summarised from the JSON output):
→ status: VALID (signatures checked; newest receipts not checked without a checkpoint)
(or) status: TAMPERED (hash mismatch at seq 37)Start with the console beta — free during beta.
Create a workspace at Create a workspace, or inspect the free open-source core. NOA Mandate Enterprise is the commercial offering; paid plans may follow with notice. There is no run-it-for-you hosted Gate; it runs on your own host.
$npm install noa-receipt
Coming to the App Store and Google Play; neither store offers it yet
No waitlist for the open-source core. The Enterprise Console is live in beta; signup is open at Create a workspace, free during beta, with no SLA. Do not put a protected production action behind it. Phone approval through the relay was last proven for our own workspace on 29 September 2026. The Gate — the program that holds an action, asks for approval and issues a one-time grant — is an open-source reference (prototype); the vault lock (vault guard) is being built. Pilots start after the vault lock’s core parts are built and checked by someone other than its builders. There is no run-it-for-you hosted Gate; it runs on your own host.