> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Noma Security

> Use Noma Security AI-DR runtime protection profiles with Bifrost Enterprise to block, mask, or alert on LLM prompts, responses, and tool activity.

## Overview

Bifrost Enterprise supports **Noma Security AI-DR** (AI Detection & Response) as a third-party guardrail provider for LLM requests, responses, tool calls, and tool results.

Noma owns the detection policy. Detectors, sensitivity, and the action for each detector are configured in the **Runtime Protection profile** assigned to a Noma application. Attach the Noma profile to a Bifrost rule to choose which traffic is evaluated; Bifrost enforces Noma's decision inline.

| Noma decision | Bifrost behavior |
| - | - |
| **Allow** | The request or response continues unchanged. |
| **Alert** | The content continues unchanged; the detection is recorded in Bifrost guardrail logs and in Noma. |
| **Mask** | Bifrost replaces each value Noma flagged using the profile's redaction strategy and mode, for example `[CREDIT_CARD]`. With `redaction_mode: logs_only`, the request and response stay unchanged and only stored logs are masked. |
| **Block** or **Ask** | Bifrost returns a guardrail intervention. `ask` is treated as a block because a gateway cannot prompt the end user. |

> [!NOTE]
>
> If Bifrost cannot interpret or safely apply a Noma decision, for example an unrecognized decision or a masked value it cannot locate in the content, it fails closed with a guardrail intervention instead of forwarding the original content.

## Prerequisites

* Bifrost Enterprise with guardrails enabled
* A Noma client credential (Client ID and Client Secret), created in Noma under **Settings** > **API Keys**
* A Runtime Protection profile in Noma for the applications your traffic reports to
* Network egress from Bifrost to your Noma environment over HTTPS

## Set Up Noma

1. Create a client credential under **Settings** > **API Keys**.
2. Choose how traffic maps to Noma applications:
   * Leave **Application ID** empty in Bifrost to report each virtual key as its own application, named after the key. Noma creates the application on the key's first request.
   * Or enter the ID of an application from **Runtime Protection** > **Applications** to report all traffic of this configuration to it.
3. Assign a Runtime Protection profile to each application and choose each detector's action: off, alert, mask, or block. Check the profile of any application Noma creates for you.
4. Copy the Client ID and Client Secret, and the Application ID if you use one, into Bifrost.

> [!TIP]
>
> The application selects the profile Noma applies and groups traffic in Noma's **Runtime Protection** > **Sessions** view. Reporting by virtual key lets each key carry its own profile.

## How It Works

1. Create a Bifrost provider configuration with `provider_name: "noma-security"`.
2. Attach it to a guardrail rule that applies to `input`, `output`, or `both`.
3. Bifrost sends the conversation to Noma before the LLM call, and the completed assistant response after it. Noma evaluates the latest turn: the newest user message and the tool calls, tool results, and response that follow it.
4. Noma returns a decision for each item, and Bifrost applies it to the matching request, response, tool-call argument, or tool result.

When Noma blocks or asks, Bifrost rejects the request, or ends the stream, with a `guardrail_intervention` error that carries Noma's evidence, for example `Blocked by Noma AI-DR policy: Email detected in the user prompt`. Policies your Noma profile runs deferred are evaluated after Noma replies: they appear in Noma but do not block or mask the request.

Each scan carries the application, the Bifrost request ID, and the authenticated user when there is one. The session is the one Bifrost resolves for the request: the `x-bf-session-id` header, else the client's own session header (for example, Claude Code's `x-claude-code-session-id`), so related requests are grouped in Noma; otherwise each request is its own session. When client IP capture is enabled (`logs_store.capture_client_ip`), the caller's IP is sent too.

### Streaming Responses

When Noma is the only provider enforcing a rule's output, Bifrost streams responses progressively. It sends Noma the response generated so far at sentence boundaries and releases text as soon as Noma clears it.

* A **block** ends the stream after the text already delivered.
* A **mask** is applied to text that has not been delivered yet. If a mask would change text the client already received, the stream ends instead.
* If Noma cannot be reached during a stream, Bifrost follows the standard guardrail behavior: the error is reported and the affected text continues to the client unscanned.
* On Responses API streams, including Claude Code through Bifrost, a **tool call** and everything after it is held until Noma's final verdict, so a blocked tool call never reaches the client.

Bifrost holds the complete response and evaluates it once when another provider also enforces the output, for Chat Completions requests that declare tools, and for requests that ask for more than one choice.

## Configuration Fields

| Field | Type | Required | Default | Description |
| - | - | - | - | - |
| `client_id` | string | Yes | - | Noma client credential ID. Supports `env.NOMA_CLIENT_ID`. |
| `client_secret` | string | Yes | - | Noma client credential secret. Supports `env.NOMA_CLIENT_SECRET`. |
| `application_id` | string | No | virtual key name | Noma application whose Runtime Protection profile decides each action. When empty, each request reports to an application named after its virtual key, which Noma creates on first use; requests without a virtual key send no application. |
| `base_url` | string | No | `https://api.noma.security` | Noma API root: `https://api.us2.noma.security` (Azure), `https://api.eu.noma.security`, `https://api.ap.noma.security`, `https://api.ap5.noma.security`, or your Noma broker URL. Changing it on a saved profile requires re-entering `client_secret`. |
| `redaction_strategy` | string | No | `replace` | How masked values are rendered: `replace`, `mask`, or `hash`. |
| `redaction_mode` | string | No | `runtime` | Where masking applies: `runtime` and `runtime_reversible` mask the request and response, while `logs_only` leaves them unchanged and masks only stored logs. See [Guardrail Redaction](https://docs.getbifrost.ai/enterprise/guardrails/redaction.md). |
| `timeout` | integer | No | `30` | Provider execution timeout in seconds. |

## Configure Bifrost

> [tab] Web UI
>
> ![Noma Security configuration in the Bifrost Guardrails Providers screen](https://mintcdn.com/bifrost/tq-8h51WVPtSeqsl/media/guardrails/noma-security-configuration.png?fit=max\&auto=format\&n=tq-8h51WVPtSeqsl\&q=85\&s=e2811fb30b5d0126a99ebd20b2aef199)
>
> 1. Go to **Guardrails** > **Providers**.
> 2. Select **Noma Security** and click **Add Configuration**.
> 3. Enter a descriptive **Name**, the **Client ID** and **Client Secret**, and optionally the **Application ID**.
> 4. Optionally enter the **Base URL** of your Noma region or broker. It defaults to `https://api.noma.security`.
> 5. Choose the redaction mode and strategy used when Noma masks content.
> 6. Set the timeout, enable the configuration, click **Verify**, then save it. Verification runs a dry-run scan, so nothing is stored in Noma.
> 7. Under **Guardrails** > **Rules**, attach the saved Noma profile to an input, output, or both-phase rule.

> [tab] API
>
> Create the Noma provider configuration with the management API:
>
> ```bash theme={null}
> curl -X POST http://localhost:8080/api/guardrails/noma-security \
>   -H "Content-Type: application/json" \
>   -d '{
>     "name": "noma-production",
>     "enabled": true,
>     "config": {
>       "client_id": "env.NOMA_CLIENT_ID",
>       "client_secret": "env.NOMA_CLIENT_SECRET",
>       "application_id": "bifrost-production",
>       "base_url": "https://api.noma.security",
>       "redaction_strategy": "replace",
>       "redaction_mode": "runtime",
>       "timeout": 30
>     }
>   }'
> ```
>
> Fetch the generated configuration ID:
>
> ```bash theme={null}
> curl -X GET http://localhost:8080/api/guardrails/noma-security
> ```
>
> Attach it to a rule by referencing `noma-security:<id>` in `selectedGuardrailProfiles`:
>
> ```bash theme={null}
> curl -X POST http://localhost:8080/api/guardrails/rules \
>   -H "Content-Type: application/json" \
>   -d '{
>     "name": "noma-all-traffic",
>     "description": "Apply Noma AI-DR to prompts and completions",
>     "enabled": true,
>     "celExpression": "true",
>     "applyTo": "both",
>     "samplingRate": 100,
>     "timeout": 60,
>     "selectedGuardrailProfiles": ["noma-security:26"]
>   }'
> ```

> [tab] config.json
>
> ```json theme={null}
> {
>   "guardrails_config": {
>     "guardrail_providers": [
>       {
>         "id": 26,
>         "provider_name": "noma-security",
>         "policy_name": "noma-production",
>         "enabled": true,
>         "timeout": 30,
>         "config": {
>           "client_id": "env.NOMA_CLIENT_ID",
>           "client_secret": "env.NOMA_CLIENT_SECRET",
>           "application_id": "bifrost-production",
>           "base_url": "https://api.noma.security",
>           "redaction_strategy": "replace",
>           "redaction_mode": "runtime"
>         }
>       }
>     ],
>     "guardrail_rules": [
>       {
>         "id": 261,
>         "name": "noma-all-traffic",
>         "description": "Apply Noma AI-DR to prompts and completions",
>         "enabled": true,
>         "cel_expression": "true",
>         "apply_to": "both",
>         "sampling_rate": 100,
>         "timeout": 60,
>         "provider_config_ids": [26]
>       }
>     ]
>   }
> }
> ```

> [tab] Helm
>
> ```yaml theme={null}
> bifrost:
>   guardrails:
>     providers:
>       - id: 26
>         provider_name: "noma-security"
>         policy_name: "noma-production"
>         enabled: true
>         timeout: 30
>         config:
>           client_id: "env.NOMA_CLIENT_ID"
>           client_secret: "env.NOMA_CLIENT_SECRET"
>           application_id: "bifrost-production"
>           base_url: "https://api.noma.security"
>           redaction_strategy: "replace"
>           redaction_mode: "runtime"
>
>     rules:
>       - id: 261
>         name: "noma-all-traffic"
>         description: "Apply Noma AI-DR to prompts and completions"
>         enabled: true
>         cel_expression: "true"
>         apply_to: "both"
>         sampling_rate: 100
>         timeout: 60
>         provider_config_ids: [26]
> ```

## Supported Content and Limitations

* **Latest turn only:** Noma evaluates the newest user message and everything after it. Earlier turns are context and are not re-evaluated, and Noma does not re-report items it already scanned in the same session. A value masked on one turn is therefore not masked again when the client replays it in later turns.
* **Tool calls and tool results:** Noma evaluates tool-call arguments and tool results, and Bifrost can block or mask them. The rules above cover model traffic; to guard MCP tool executions, attach the Noma profile to a separate rule with the `mcp` target (see [MCP Guardrails](https://docs.getbifrost.ai/enterprise/guardrails.md#mcp-guardrails)).
* **System prompts and images:** Noma does not evaluate system prompts or image content.
* **Fallbacks:** When a request falls back to another provider, Bifrost reapplies the first attempt's Noma decision instead of scanning the same content again.

For shared rule behavior, CEL scoping, and audit logging, see [Guardrails](https://docs.getbifrost.ai/enterprise/guardrails.md). For the general redaction model, see [Guardrail Redaction](https://docs.getbifrost.ai/enterprise/guardrails/redaction.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.