Runtime policy enforcement for LLM agent tool calls on Kubernetes.
LLM agents are given real tools — databases, shells, email, cloud APIs. The model chooses which to call at runtime, and one prompt injection or reasoning error turns a benign agent into an exfiltration path.
Norviq is a policy enforcement point that sits between an agent's reasoning loop and the tools it can call. Every tool call is intercepted, evaluated against OPA/Rego policy scoped to the workload's SPIFFE identity, and then allowed, blocked, escalated, or audited — before the tool runs.
Agent tool call ──▶ Intercept ──▶ Identify ──▶ Evaluate ──▶ Enforce
{tool, params} sidecar/SDK SPIFFE OPA / Rego allow · block ·
identity + overlays escalate · audit
Every decision carries a rule_id and a reason, lands in the audit log, and updates the agent's
behavioural trust score.
| norviq | The platform — engine, console, admission webhook, Helm chart, CLI, and the framework SDKs. |
helm install norviq oci://ghcr.io/norviq-dev/charts/norviq --version 0.2.5 -n norviq \
--set 'policyQuotaNamespaces={default}'norviq.dev has an in-browser policy tester — fire an attack, watch the
verdict, and cycle any baseline control between enforce, monitor and off to see the decision
change. It runs entirely client-side.
LangChain · LangGraph · CrewAI · AutoGen · Semantic Kernel — or drop the
sidecar in front of any workload with no code change. MCP servers are governed by a two-gate
firewall: tool definitions are content-hash pinned and scanned at discovery, and the resulting
tools/call is evaluated like any other call.
Issues labelled good first issue
are the on-ramp. Security reports go through the process in
SECURITY.md — please don't open a
public issue for those.
Apache 2.0.