The whole agent runtime. One spine. Zero ungated side effects.

The orchestrator decomposes work, dispatches it to the right agent, and owns the loop — retries, timeouts, escalation, and completion. Agents reason; the platform decides what runs, in what order, with what permissions. That separation is deliberate: reliability lives in deterministic infrastructure, not inside a model's context window.

Loops are turn-bounded and lease-owned. A task that stalls is reclaimed and retried with capped backoff; a task that loops is cut at its bound; a task that dies is dead-lettered with its full gate history attached. No zombie agents, no runaway spend.

Inference is COGS. NornGate treats it that way with a two-tier design: the majority of every workload runs on NornGate's own LLM, on NornGate-operated GPUs, at a marginal cost measured in pennies. Steps that need frontier judgment are handed off to the provider you choose — Anthropic, OpenAI, xAI, DeepSeek, or any model reachable via OpenRouter.

Because G3 verifies output against a contract regardless of which tier produced it, the split is safe by construction: work that passes verification on the in-house tier simply never incurs frontier pricing, with no quality gamble. Provider failover is automatic; your workflows never learn which vendor had an outage.

NornGate ships sixteen agents, each named for a Norse god and each mapped to a single engineering function — retrieval, drafting, reconciliation, scheduling, escalation, and the rest. Narrow agents with declared contracts beat one god-model with root access: a scoped agent can only be granted scoped permissions, which is what makes G1 policies short enough to actually read.

Agents hold no credentials. They request actions; the gates decide. An agent compromised by a hostile prompt can ask for anything — and receive only what policy already allowed it.

Every service in NornGate hangs off a single service mesh — Yggdrasil — and every subdomain is a realm with its own trust zone. Subdomain = trust boundary is not branding; it means traffic between realms is authenticated, authorized, and logged at the mesh, and a component in one realm cannot reach another realm's data plane at all.

For you, the practical consequence: there is exactly one place where "who can talk to whom" is defined, and it's the same place your auditor reads it.

Observability in NornGate is the Norn triad. Urd keeps the past — the append-only ledger of every gate verdict and G4 commit, cryptographically signed and hash-chained. Verdandi watches the present — live gate transits, approval queues, spend against budget. Skuld holds what is permitted to come — the policy set that decides every future action.

The ledger is GDPR-shaped by design: hashes are anchored immutably; payloads stay erasable. When an Article 17 erasure request arrives, the record's content is destroyed while the chain's integrity — the proof that the action occurred and passed its gates — survives intact.