About

An operating layer that agents can be held to

AI agents are starting to act on your computer: running code, moving money, touching your files. Noren is the layer that lets them do that safely. It gives people and agents a small set of host-level controls (intent, runtime, memory, identity, permissions, comms, a compositor, and settlement) so they can share one machine without having to trust each other. It runs where your work runs, not behind someone else's API.

1. 01

   The operating layer, not a wrapper

   Think of an operating system: it sits between your apps and the hardware and decides what each one is allowed to do. Noren is that layer for AI agents. It exposes eight capabilities through one local service (a daemon) over your machine's own internal channels: intent, runtime, memory, identity, permissions, comms, compositor, and settlement. It doesn't replace your operating system, and it isn't a website you call out to. It's infrastructure that runs on the machine where the work happens, under your control.

2. 02

   Permission, not trust

   Most software trusts an agent the moment it starts running. It can quietly reach anything the program itself can. Noren flips that. An agent gets no standing access. Every privileged action needs a capability: a cryptographically signed permission slip (ed25519) that names one specific action, can be narrowed to a scope, expires, and can be revoked. It is checked the instant the action is attempted, so an agent can do exactly what you signed for and nothing else, and the check runs the same way whether the action succeeds or fails.

3. 03

   A receipt for every decision

   Every consequential thing the system does is written down as it happens: who was issued an identity, which permissions were checked, what was settled. It all goes into a tamper-evident log: append-only and hash-chained, so any later edit breaks the chain and shows. Each entry records what kind of event it was, who issued it, and when, and you can verify the whole chain yourself, on your own machine. The result is a receipt for every decision the system makes, kept no matter the outcome.

4. 04

   Open source, and checkable

   Noren is open source under the Apache License 2.0, and it is built on an existing open-source project (see the credits below). You can run the same daemon the sandbox uses, send it a task, and verify the hash-chained audit log yourself. Nothing here asks you to trust a claim you cannot check.

5. 05

   Local-first, and yours

   One key, on your hardware, is the root of everything. A single ed25519 keypair per install signs your permission grants, signs on-chain settlement, and stamps the audit log. One identity ties it all together. Your agents, your memory, and your keys stay on your machine by default. The core is open source under the Apache License 2.0, and the protocol is public, so how Noren works is never hidden behind a service you can't inspect.

6. 06

   What's real, stated plainly

   We are careful to separate what ships from what is planned. Today the local control plane is real and tested: the workspace has 50 Rust crates and about 3,870 tests, 486 of which run against a live daemon. Production-grade isolation for untrusted code and networked multi-peer operation are on the roadmap, not the changelog; settlement is built for Robinhood Chain (chain 4663, USDG), and its daemon-driven per-intent lifecycle is not yet production. An agent's identity, reputation, and bond receipts are published as signed statements any contract can check in one step; the parts not exercised yet, like on-chain reputation writes and funded bonds, we mark as such. The line between done, experimental, and planned is documented in BUILT.md and throughout the docs. If a claim is not true yet, we do not make it.