Skip to content

Back to the catalog

Nomos
github.comrepo

Nomos

Nomos is an open-source permission/authorization layer for custom AI agent tools: agents propose actions (e.g. email.send), and Nomos evaluates them against a policy as ALLOW, DENY, or REQUIRE_APPROVAL before the underlying tool executes. It ships a CLI for writing and running permission tests in CI (with a GitHub Actions example pinning a checksummed release), a Python SDK for wrapping tools with explicit external authorization, and a LangGraph integration that pauses a workflow for human review before resuming execution.

TL;DR Policy-as-code permission layer that gates AI agent tool calls behind allow/deny/human-approval rules, testable in CI via a Go CLI and integrable with LangGraph/Python agents.
Open original ↗
Document

What it is

Nomos (v0.13.3+ required for the quickstart) is an open-source permission layer for custom AI agent tools you build and own — not, as the catalog summary implies, a general execution-boundary proxy for off-the-shelf agents. The page is explicit about scope: "Use it when you own the application exposing the tools." Your agent proposes an action; your code asks Nomos whether it is ALLOW, DENY, or REQUIRE_APPROVAL before calling the tool. It ships as a prebuilt CLI plus a Python SDK.

How it works

Policy is expressed as a YAML bundle plus a JSON permission suite that you test like code. Each action carries a domain action_type (e.g. email.send) and a resource URI the policy matches against. DENY wins over REQUIRE_APPROVAL. For approval-gated actions, a separately authorized reviewer records a decision; you retry the saved request with its approval ID. A fingerprint binding rejects changed arguments, rejected approvals, and expired approvals — so resuming a paused workflow is not itself approval. Your tool implementation and provider credentials stay in trusted application code; Nomos only supplies the decision and records reported outcomes. Policy bundles are content-hashed (the suite prints a policy digest) so changes are detectable.

What to do

Install the CLI (macOS/Linux/Windows, x86-64/ARM64):

brew install safe-agentic-world/nomos/nomos
nomos version

Run the local policy test — no server, Python, or tool execution:

git clone https://github.com/safe-agentic-world/nomos.git
cd nomos
nomos test --suite examples/local-inbox/permissions.json --bundle examples/local-inbox/policy.yaml

For the human-review demo (Python 3.10+, real LangGraph, local SQLite inbox):

python3 -m venv .venv
.venv/bin/python -m pip install -e "./sdk/python[langgraph]"
.venv/bin/python examples/local-inbox/demo.py

The demo prints a temporary directory holding the inbox, approvals, audit records, and development credentials — keep it private and delete it when done.

Caveats

The most important correction: the catalog summary overclaims. The page states Nomos "is not a sandbox or a prompt-injection detector" and does not describe blocking rm -rf/terraform destroy, redacting output, or brokering credentials for third-party agents like Cursor or Codex. It is a decision-and-audit layer for tools in your own application, meant to complement (not replace) framework and runtime controls. It does not execute tools or hold your provider credentials. Internet access is needed only for installation; the local demo runs offline and sends no email.

If you came here expecting the summary's broad proxy, verify against the actual project before planning around it.

Technologies named here

Techniques named here

  • Approval fatigue
  • Bash string-matched deny rules bypass
  • Command parsing and normalization for policy evaluation
  • Deny-wins deterministic policy evaluation

Related in AI Security