The answers your security team will ask for first.
Your code: Code and evidence stay on your machines or in your VPC. Nool never receives your source code. Network calls: The CLI contacts nool.dev only for licence and device activation. Licences are signed tokens that verify offline. Identity: Role grants are signed by an issuer you control, or come from your identity provider through nool login (device flow). Certifications: Nool does not hold SOC 2 or ISO 27001 today. Because code and evidence stay with you, Nool never processes your source code. nool audit verify produces evidence for your own audits. Air-gapped and continuity: Air-gapped deployment is available on Enterprise. Enterprise contracts include source escrow, so you receive the source if Nool stops supporting the product. Reporting: Send vulnerability reports and security questionnaires to help@nool.dev. Our security.txt is at /.well-known/security.txt.
Cryptographic Identity
Every Knot, Thread, and release is signed with Ed25519, tying every agent-authored change to a verifiable identity. Teams can prove who — human or agent — authored what, when, and under which authority. Ed25519 key pairs for every operator (human and agent). Signed Knot graph with Merkle-causal hash chaining. Per-Thread identity binding prevents cross-thread forgery. Release signing creates a tamper-evident shipment record. Role-gated grants (editor, approver, admin, checker) from an issuer you control, or from your identity provider with nool login. A signed, hash-chained revocation ledger for compromised keys, knots and receipts.
WASM-Sandboxed Policy Gates
Aram Gates run as WASM bytecode in a sandboxed runtime. Every policy is version-pinned, fuel-metered, and hash-verified before execution — no ambient system access, no injection risk. Wasmtime runtime — no syscalls, no filesystem, no network. Fuel metering prevents policy-based DoS attacks. Version-pinned by content hash — supply-chain verified. Policies evaluated before any mutation reaches the DAG. Gate failures produce signed evidence for audit trails. Pre-tool checks stop a forbidden agent edit or shell command before it runs. Rego and forbid-only Cedar policies hosted beside WASM and DSL rules. One organisation floor that every repository can tighten, never weaken.
Replayable Audit Trails
Every mutation is recorded as a causally linked Knot with full provenance: who proposed it, what policies checked it, which findings informed it, and why it was accepted or rejected. Deterministic replay — reconstruct any state from intent through release. Full causal chain: intent → plan → review → solidify → release. Policy decisions captured as signed evidence bundles. Drift detection flags unreviewed state mutations automatically. Branch-agnostic lineage survives rebases and squash merges. A signed gate receipt on every landing, with each policy's result and the evidence it read. nool audit verify: PASS or FAIL per SOC 2, PCI DSS, HIPAA, GDPR, SOX ITGC and ISO 27001 control, reproducible from a clone.
Shadow AI Defense
When agents operate without governance, off-book changes accumulate silently. Nool's attribution and policy layer makes unauthorized agent activity visible, accountable, and blockable. Intent Announcements surface agent plans before execution. Orphan Knot detection flags changes without declared intent. Policy history provides an immutable ledger of every gate decision. Approval workflows ensure human-in-the-loop for sensitive transitions. Drift alerts catch agents operating on stale repository state. An optional model council (nool council) as an extra check that sits on top of your rules, never in place of them.
Threats Nool Prevents
Stale plan execution: State-bound Knots reject plans reviewed against outdated repository state. Execution fails before any mutation occurs. Scope drift / hidden changes: Intent Announcements declare blast radius. Policy gates verify every mutation is within declared scope. Supply-chain policy tampering: WASM gates are content-addressed and hash-verified. Any modification changes the gate identity and triggers audit alerts. Off-book agent activity: Orphan Knot detection flags transitions without declared intent. Policy gates enforce intent declaration before acceptance. Multi-agent semantic collision: Intent Threads with resource-level contention detection. Agents are blocked before they overwrite overlapping semantic territory. Audit trail forgery: Merkle-causal DAG + Ed25519 signatures make retrospective tampering detectable with a single hash comparison.
Frequently asked questions
- How does Nool integrate with Google SAIF, Salesforce Einstein Trust Layer, or Databricks DASF?
- Nool completes the AI trust stack. While frameworks like Google SAIF, Databricks DASF, or Cloudflare AI Gateway protect the LLM (preventing prompt injection, toxicity, and data leakage), Nool protects the codebase from the LLM. It acts as the execution trust layer, ensuring autonomous agents cannot merge architectural drift or violate code-level policies.
- How can I stop a single agent from landing bad code?
- Your rules decide first: deterministic gates refuse a change that breaks them, whatever the agent claims, and give the same verdict every time. For sensitive paths, require named human approval. nool council can add a quorum of models you choose as an extra check that can veto a change; it sits on top of your rules, never in place of them.
- How are WASM policies protected from tampering?
- Every Aram Gate is identified by its SHA-256 content hash. The nool.toml pins the expected hash for each gate. If the gate binary is modified — even one byte — the hash changes, the policy is rejected, and the event is recorded in the audit trail.
- Does Nool send code to external servers?
- No. Code and evidence stay on your machines or in your VPC, and policy evaluation runs locally in the Wasmtime sandbox. The CLI contacts nool.dev only for licence and device activation; licences are signed tokens that verify offline. Git pushes and pulls go only to the remotes you configure.
- What happens if someone's signing key is compromised?
- Nool supports key rotation and revocation. You can revoke a compromised key by publishing a revocation certificate to the repository. All Knots signed after the revocation timestamp require re-signing with a valid key.
- How does Nool support audit review for AI-authored code?
- Nool's signed evidence bundles and replayable audit trails help teams review AI-authored changes with durable provenance. Every policy decision, approval, and rejection is captured as a signed, timestamped, exportable record.
- Can Nool block an agent mid-execution?
- Yes. State-bound Knots are invalidated if the repository state changes between plan review and solidification. If an agent's declared intent no longer matches the current DAG state, the solidify command is rejected and the agent must re-propose.
- How are licences verified, and what happens if Nool disappears?
- Licences are signed tokens that verify offline on the engineer's machine; the hub only issues and renews them, and Enterprise contracts add air-gapped licences with no hub in the loop. Enterprise contracts also include source escrow: if Nool stops trading or stops supporting the product, you receive the source.
- Does Nool hold SOC 2 or ISO 27001?
- Not today. Because your code and evidence stay on your machines or in your VPC, Nool never processes your source code. For your own audits, nool audit verify checks your repository's history against SOC 2, ISO/IEC 27001:2022, PCI DSS, HIPAA, GDPR and SOX ITGC controls and reports PASS or FAIL for each, reproducible from a clone.
- How do I report a vulnerability or send a security questionnaire?
- Email help@nool.dev. Our security.txt at /.well-known/security.txt lists the same contact.