Control what agents are allowed to do.
Noma Access Control is the governance and enforcement layer for agents, MCP servers and skills. Define which agents and tools are approved, scope permissions by user identity, and enforce policies at the moment a connection or action is attempted.
the Challenge
Agents need access to sensitive systems to do their work, and that access is not centrally managed. Employees deploy agents and connect them to skills and MCPs, but the IdP doesn't know these agents exist.
Noma Solution
Noma Access Control gives security teams control over agent usage. Define an AI Registry of what agents, MCPs, and skills are allowed. Implement granular access policies for every agent, MCP, and skills, enforcing it across your AI infrastructure.
How Agent access control works
Noma enables organizations to discover, govern, test, and protect AI and agents across the enterprise.
Unified control for agent access
Every agent, MCP server, and skill in your environment gets a clear status: approved, needs review, or blocked. Noma auto-populates the registry from discovery data, so the baseline is built for you. When someone connects to something new, it's flagged and categorized before any data flows.
A single place where security teams define the rules, scoped by team, role, or individual identity.
User-based and tool-based policies
Define and enforce which agents can use specific skills and tools within an MCP, based on criteria like runtime context and the human the agent is attributed to.
Defend from risky behavior
Monitor agent behavior in runtime, even after access to approved MCPs or skills, and stop risky actions or rogue agents from making mistakes. Noma matches agent behavior to intent and baseline to find cases where even legitimate actions can combine into dangerous behavior.
All-surface governance
Enforce policies across MCP, skills, and native tools through the AI infrastructure you already have such as gateways, EDR, MDM, and agent hooks. No re-architecting for security required.
Use cases
Part of the Noma platform
Access Control is one piece of a broader AI security program. Discovery feeds the registry. Red teaming findings inform what policies to set. Access policies make runtime detections more precise. Each product shares context with the others, so every decision is informed by the full picture.
Surface all AI assets and their risks
Noma finds every agent, model, MCP server and tool across your cloud, SaaS, and developer environments - often discovering 10 to 100x more agents than teams expect - and surfaces universal risks in your AI estate.
Set and enforce the rules
Define which agents are approved, what data they can access, and what actions they can take - enforcing policies in real time, before actions are carried out.
Test AI apps & agents continuously
Noma’s agents probe your AI apps and agents for prompt injection, jailbreak, data leakage, and goal drift - using sophisticated multi-turn attacks that uncover agent and model weaknesses.
See and stop threats in context
Every agent action looks normal on its own. The threat only appears in context. Noma monitors the full behavioral chain of every agent session (prompts, tool calls, data access, actions) and detects prompt injection, data exfiltration, and scope violations in real time.
