Noma Security

Overview

Bifrost Enterprise supports Noma Security AI-DR (AI Detection & Response) as a third-party guardrail provider for LLM requests, responses, tool calls, and tool results. Noma owns the detection policy. Detectors, sensitivity, and the action for each detector are configured in the Runtime Protection profile assigned to a Noma application. Attach the Noma profile to a Bifrost rule to choose which traffic is evaluated; Bifrost enforces Noma’s decision inline.

Noma decision	Bifrost behavior
Allow	The request or response continues unchanged.
Alert	The content continues unchanged; the detection is recorded in Bifrost guardrail logs and in Noma.
Mask	Bifrost replaces each value Noma flagged using the profile’s redaction strategy and mode, for example `[CREDIT_CARD]`. With `redaction_mode: logs_only`, the request and response stay unchanged and only stored logs are masked.
Block or Ask	Bifrost returns a guardrail intervention. `ask` is treated as a block because a gateway cannot prompt the end user.

If Bifrost cannot interpret or safely apply a Noma decision, for example an unrecognized decision or a masked value it cannot locate in the content, it fails closed with a guardrail intervention instead of forwarding the original content.

Prerequisites

Bifrost Enterprise with guardrails enabled
A Noma client credential (Client ID and Client Secret), created in Noma under Settings > API Keys
A Runtime Protection profile in Noma for the applications your traffic reports to
Network egress from Bifrost to your Noma environment over HTTPS

Set Up Noma

Create a client credential under Settings > API Keys.
Choose how traffic maps to Noma applications:
- Leave Application ID empty in Bifrost to report each virtual key as its own application, named after the key. Noma creates the application on the key’s first request.
- Or enter the ID of an application from Runtime Protection > Applications to report all traffic of this configuration to it.
Assign a Runtime Protection profile to each application and choose each detector’s action: off, alert, mask, or block. Check the profile of any application Noma creates for you.
Copy the Client ID and Client Secret, and the Application ID if you use one, into Bifrost.

The application selects the profile Noma applies and groups traffic in Noma’s Runtime Protection > Sessions view. Reporting by virtual key lets each key carry its own profile.

How It Works

Create a Bifrost provider configuration with provider_name: "noma-security".
Attach it to a guardrail rule that applies to input, output, or both.
Bifrost sends the conversation to Noma before the LLM call, and the completed assistant response after it. Noma evaluates the latest turn: the newest user message and the tool calls, tool results, and response that follow it.
Noma returns a decision for each item, and Bifrost applies it to the matching request, response, tool-call argument, or tool result.

When Noma blocks or asks, Bifrost rejects the request, or ends the stream, with a guardrail_intervention error that carries Noma’s evidence, for example Blocked by Noma AI-DR policy: Email detected in the user prompt. Policies your Noma profile runs deferred are evaluated after Noma replies: they appear in Noma but do not block or mask the request. Each scan carries the application, the Bifrost request ID, and the authenticated user when there is one. The session is the one Bifrost resolves for the request: the x-bf-session-id header, else the client’s own session header (for example, Claude Code’s x-claude-code-session-id), so related requests are grouped in Noma; otherwise each request is its own session. When client IP capture is enabled (logs_store.capture_client_ip), the caller’s IP is sent too.

Streaming Responses

When Noma is the only provider enforcing a rule’s output, Bifrost streams responses progressively. It sends Noma the response generated so far at sentence boundaries and releases text as soon as Noma clears it.

A block ends the stream after the text already delivered.
A mask is applied to text that has not been delivered yet. If a mask would change text the client already received, the stream ends instead.
If Noma cannot be reached during a stream, Bifrost follows the standard guardrail behavior: the error is reported and the affected text continues to the client unscanned.
On Responses API streams, including Claude Code through Bifrost, a tool call and everything after it is held until Noma’s final verdict, so a blocked tool call never reaches the client.

Bifrost holds the complete response and evaluates it once when another provider also enforces the output, for Chat Completions requests that declare tools, and for requests that ask for more than one choice.

Configuration Fields

Field	Type	Required	Default	Description
`client_id`	string	Yes	-	Noma client credential ID. Supports `env.NOMA_CLIENT_ID`.
`client_secret`	string	Yes	-	Noma client credential secret. Supports `env.NOMA_CLIENT_SECRET`.
`application_id`	string	No	virtual key name	Noma application whose Runtime Protection profile decides each action. When empty, each request reports to an application named after its virtual key, which Noma creates on first use; requests without a virtual key send no application.
`base_url`	string	No	`https://api.noma.security`	Noma API root: `https://api.us2.noma.security` (Azure), `https://api.eu.noma.security`, `https://api.ap.noma.security`, `https://api.ap5.noma.security`, or your Noma broker URL. Changing it on a saved profile requires re-entering `client_secret`.
`redaction_strategy`	string	No	`replace`	How masked values are rendered: `replace`, `mask`, or `hash`.
`redaction_mode`	string	No	`runtime`	Where masking applies: `runtime` and `runtime_reversible` mask the request and response, while `logs_only` leaves them unchanged and masks only stored logs. See Guardrail Redaction.
`timeout`	integer	No	`30`	Provider execution timeout in seconds.

Configure Bifrost

Web UI
API
config.json
Helm

Noma Security configuration in the Bifrost Guardrails Providers screen

Go to Guardrails > Providers.
Select Noma Security and click Add Configuration.
Enter a descriptive Name, the Client ID and Client Secret, and optionally the Application ID.
Optionally enter the Base URL of your Noma region or broker. It defaults to https://api.noma.security.
Choose the redaction mode and strategy used when Noma masks content.
Set the timeout, enable the configuration, click Verify, then save it. Verification runs a dry-run scan, so nothing is stored in Noma.
Under Guardrails > Rules, attach the saved Noma profile to an input, output, or both-phase rule.

Create the Noma provider configuration with the management API:

curl -X POST http://localhost:8080/api/guardrails/noma-security \
  -H "Content-Type: application/json" \
  -d '{
    "name": "noma-production",
    "enabled": true,
    "config": {
      "client_id": "env.NOMA_CLIENT_ID",
      "client_secret": "env.NOMA_CLIENT_SECRET",
      "application_id": "bifrost-production",
      "base_url": "https://api.noma.security",
      "redaction_strategy": "replace",
      "redaction_mode": "runtime",
      "timeout": 30
    }
  }'

Fetch the generated configuration ID:

curl -X GET http://localhost:8080/api/guardrails/noma-security

Attach it to a rule by referencing noma-security:<id> in selectedGuardrailProfiles:

curl -X POST http://localhost:8080/api/guardrails/rules \
  -H "Content-Type: application/json" \
  -d '{
    "name": "noma-all-traffic",
    "description": "Apply Noma AI-DR to prompts and completions",
    "enabled": true,
    "celExpression": "true",
    "applyTo": "both",
    "samplingRate": 100,
    "timeout": 60,
    "selectedGuardrailProfiles": ["noma-security:26"]
  }'

{
  "guardrails_config": {
    "guardrail_providers": [
      {
        "id": 26,
        "provider_name": "noma-security",
        "policy_name": "noma-production",
        "enabled": true,
        "timeout": 30,
        "config": {
          "client_id": "env.NOMA_CLIENT_ID",
          "client_secret": "env.NOMA_CLIENT_SECRET",
          "application_id": "bifrost-production",
          "base_url": "https://api.noma.security",
          "redaction_strategy": "replace",
          "redaction_mode": "runtime"
        }
      }
    ],
    "guardrail_rules": [
      {
        "id": 261,
        "name": "noma-all-traffic",
        "description": "Apply Noma AI-DR to prompts and completions",
        "enabled": true,
        "cel_expression": "true",
        "apply_to": "both",
        "sampling_rate": 100,
        "timeout": 60,
        "provider_config_ids": [26]
      }
    ]
  }
}

bifrost:
  guardrails:
    providers:
      - id: 26
        provider_name: "noma-security"
        policy_name: "noma-production"
        enabled: true
        timeout: 30
        config:
          client_id: "env.NOMA_CLIENT_ID"
          client_secret: "env.NOMA_CLIENT_SECRET"
          application_id: "bifrost-production"
          base_url: "https://api.noma.security"
          redaction_strategy: "replace"
          redaction_mode: "runtime"

    rules:
      - id: 261
        name: "noma-all-traffic"
        description: "Apply Noma AI-DR to prompts and completions"
        enabled: true
        cel_expression: "true"
        apply_to: "both"
        sampling_rate: 100
        timeout: 60
        provider_config_ids: [26]

Supported Content and Limitations

Latest turn only: Noma evaluates the newest user message and everything after it. Earlier turns are context and are not re-evaluated, and Noma does not re-report items it already scanned in the same session. A value masked on one turn is therefore not masked again when the client replays it in later turns.
Tool calls and tool results: Noma evaluates tool-call arguments and tool results, and Bifrost can block or mask them. The rules above cover model traffic; to guard MCP tool executions, attach the Noma profile to a separate rule with the mcp target (see MCP Guardrails).
System prompts and images: Noma does not evaluate system prompts or image content.
Fallbacks: When a request falls back to another provider, Bifrost reapplies the first attempt’s Noma decision instead of scanning the same content again.

For shared rule behavior, CEL scoping, and audit logging, see Guardrails. For the general redaction model, see Guardrail Redaction.

Getting Started

Moving from OSS

Release Cadence

Migration Guides

Features

Security

Overview

Prerequisites

Set Up Noma

How It Works

Streaming Responses

Configuration Fields

Configure Bifrost

Supported Content and Limitations

​Overview

​Prerequisites

​Set Up Noma

​How It Works

​Streaming Responses

​Configuration Fields

​Configure Bifrost

​Supported Content and Limitations

Overview

Prerequisites

Set Up Noma

How It Works

Streaming Responses

Configuration Fields

Configure Bifrost

Supported Content and Limitations