Most AI platforms are fail-open: the model acts, and safety tooling tries to catch problems afterwards. NornGate is built the other way around. Every action your AI attempts is denied by default — it executes only after passing five deterministic checks, and a failure anywhere in the chain means the action simply doesn't happen. That inversion is what makes unattended AI safe enough to run your business on.
In the Norse myth, the god Baldr was made invulnerable when his mother Frigg extracted an oath from every thing in the world not to harm him — fire, water, iron, stone, every plant and beast. She skipped mistletoe. It seemed too young, too small to matter. Baldr died to the one exception nobody listed. Every blocklist-based security model dies the same way.
The AI can do anything except what's on the blocklist. Security becomes an endless race to enumerate every dangerous action in advance — every prompt trick, every edge case, every mistletoe. Miss one, and the system fails open: the unlisted action executes. And with AI, the space of unlisted actions is infinite.
one missed exception → breach
Nothing executes without an explicit rule permitting it. There is no blocklist to maintain and no exception to forget, because the unknown is denied by construction. A new attack, a novel prompt injection, an action nobody anticipated — all of it lands in the same bucket: no rule, no execution.
one missing rule → a denied request in a log
Default-deny is enforced by a pipeline, not a promise. Every side effect — an email sent, an invoice posted, a record updated — transits all five gates in order. Each gate can only pass or refuse; none can be skipped.
A tempting shortcut in AI safety is to have a second model review the first model's actions. NornGate rejects it for a simple reason: a model policing a model is itself promptable. The manipulation that fools the worker can be crafted to fool the judge — attacker effort scales, your defense doesn't.
G1 policies are evaluated the way mature policy engines evaluate access control: as deterministic code. Same input, same verdict, every single time. Rules are human-readable, versioned, and auditable before the incident — you can answer "what would happen if an agent tried X" without trying X.
NornGate agents carry no credentials — not API keys, not passwords, not tokens. They can only request actions; the gateway holds the keys and performs only the requests that survive the gates. Prompt-inject an agent completely and you've gained the ability to ask for things policy already allowed.
This is why prompt injection — the defining unsolved problem of LLM security — changes category on NornGate. Elsewhere it's a breach vector. Here it's a request generator pointed at a wall of rules, and the wall doesn't read persuasion.
Isolation on NornGate is structural, not procedural. Every internal service lives in a realm with its own trust boundary; traffic between realms is mutually authenticated and policy-checked at the mesh, so a compromised component can't move laterally — the mesh refuses the connection before forensics would ever see it.
Isolation extends to the subtle layers most platforms miss: prompt caches are namespaced per tenant, closing the timing side channel where one customer could infer another's prompts from cache-hit latency. Agent memory, knowledge, and ledger partitions are tenant-scoped by construction.
Every gate verdict and every commit is written to an append-only ledger: signed and hash-chained, so any tampering breaks the chain visibly. "Prove what your AI did last quarter" stops being an engineering project and becomes a query — for you, and for your auditor.
The ledger resolves the classic conflict between immutability and privacy law: hashes are anchored immutably; payloads stay erasable. A GDPR Article 17 erasure request destroys the record's content while the chain's integrity — the proof that the action occurred and passed its gates — survives intact. You keep your audit trail and honor the right to be forgotten, simultaneously.
Fail-closed means every action is denied by default. An AI agent's action executes only if an explicit rule allows it and every verification step passes — if a rule is missing, a check fails, or a component errors, the action does not happen. The opposite model, fail-open, lets actions through unless something catches them.
Because a model policing a model is itself promptable — the same manipulation that fools the worker can fool the judge. NornGate's policies are evaluated as deterministic code: the same input produces the same verdict every time, and the rules can be audited before an incident, not after.
Very little. NornGate agents hold no credentials and cannot execute anything directly — they can only request actions, and every request is checked against your rules before it runs. A manipulated agent can ask for anything and receive only what policy already allowed. The blast radius is a denied request in a log, not an incident.
Yes, by design. The ledger anchors cryptographic hashes immutably while keeping the underlying payloads erasable. When an erasure request arrives under GDPR Article 17, the record's content is destroyed while the proof that the action occurred and passed its checks remains intact.
Pick the scenario that keeps you from trusting AI unattended: the rogue payment, the leaked record, the manipulated agent. We'll walk it gate by gate and show you exactly where it dies.