Noma Security and Smartflow both govern AI agents at runtime. Noma delivers policy decisions through the control points an enterprise already runs (AI gateways, MCP gateways, agent hooks, agent SDKs and platform APIs) across endpoint, SaaS and cloud agents. Smartflow enforces policy inline on every model call and MCP tool call routed through it, on the customer's own infrastructure, and records each decision. They diverge on where the decision is made, who the agent is in the record, and what that record is built to prove.
The short version
This is a close comparison. Noma describes itself as an agent security and governance platform. Its runtime product, AI-DR, carries the line "Stop dangerous agent behavior at runtime." It blocks, masks, steers or halts agent actions, judged against the full session, alongside discovery, access control and red teaming. Anyone evaluating runtime governance for agents should have it on the list.
The difference that decides it is architectural. Noma spreads enforcement across the control points a company already runs, so coverage is wide and the controls at each point are whatever that point supports. Smartflow is one control plane on the request path, where policy is evaluated before every routed call executes. The trade is that a call has to be routed through it.
Feature Comparison
| Capability | Smartflow | Noma Security |
|---|---|---|
| Primary job | Runtime enforcement inline at the gateway, on every model call and MCP tool call routed through it. | Agent security and governance across endpoint, SaaS and cloud: discovery and posture (AI-SPM), access control, runtime detection and response (AI-DR) and red teaming. |
| Enforcement point | The request path. Policy is evaluated before the prompt reaches the model and before a tool call executes. | Open Enforcement: decisions delivered at "every agent control point you already run," through AI gateways, MCP gateways, agent hooks, agent SDKs and direct APIs. Noma documents no gateway of its own. |
| Coverage | Every call routed through the gateway, from any origin, including with no network egress. | SaaS agents such as Agentforce, Microsoft Copilot and Claude Enterprise through platform APIs; endpoint agents such as Claude Code, found through existing EDR or MDM and governed through hooks; cloud agents on Bedrock, Azure AI Foundry and Databricks. "Available enforcement actions depend on the integration." |
| Deployment | On-premises, Kubernetes-native, air-gapped capable. | Noma states support for both on-premises and SaaS deployments. Air-gapped operation is not documented. |
| Content inspection | Inline content inspection: PII, prompt injection, output moderation. | Prompt injection, "including encoded and indirect injection through tool responses," data leakage with inline masking, tool poisoning, scope violations and drift, judged against session, identity, data access and baseline behavior. |
| Enforcement actions | Allow, block or redact, with policy-versioned decisions on every call, or pause the action for a person to decide. | Block, mask, steer, alert a human, route for approval, or trigger a killswitch. "Every detector is independently tunable." |
| When a person must decide | The action pauses as an approval ticket until someone with approval rights approves or denies it. With step-up, set per action, the approver re-verifies their identity before the approval counts. | The action "routes to a human for approval, with a full audit trail." Approver verification and approval expiry are not documented. |
| Agent identity | AIDA issues a cryptographic credential to the agent itself, scoped and revocable independently of its launcher. | Noma "ties each agent to its human owner and their IdP group" and keys policy to those groups. A credential issued to the agent is not documented. |
| MCP | MCP JSON-RPC gateway with tool caching, under agent identity. | Discovers MCP servers, including unapproved ones; approves or blocks servers and individual tools by server, tool and user group; inspects tool responses for hidden instructions. |
| Evidence | A record of each decision, bound to the human who owns the agent, hash-chained, time-stamped under RFC 3161 and written to your SIEM, with an optional write-once archive. | Runtime audit trails and "complete observability into every prompt, tool call, response" and interaction. Noma's blog describes AI-DR as creating "a timestamped, unalterable record." How that record is protected, such as hash-chaining or an external timestamp authority, is not documented. |
| Model routing and cost | Routing and failover across model providers, with caching. | Not documented. |
| Regulatory frameworks | Examination packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, generated from enforcement records. | Maps governance posture to NIST AI RMF, the EU AI Act, ISO 42001, OWASP and MITRE ATLAS. FINRA, HIPAA and SOX are not documented as product mappings. |
Where the decision is enforced
Noma calls its approach Open Enforcement: define governance once, and Noma "enforces it at every agent control point you already run." Its FAQ gives three examples: an agent on Bedrock behind a gateway, a Copilot Studio agent through platform APIs, and an agent on a laptop through native hooks. Noma makes the case directly: "Routing all traffic through one MCP gateway is not feasible for many organizations."
The consequence is one Noma states itself: "Available enforcement actions depend on the integration." A hook in a coding agent, a SaaS platform's API and a third-party gateway each expose different controls, so what can be stopped, masked or paused depends on where the agent runs. A buyer should ask which actions apply at each control point in their own estate.
Smartflow makes the opposite trade. It is the control point. Applications and agents send model calls and MCP tool calls through the gateway, and policy is evaluated before the call executes. Nothing is discovered automatically: a call has to be pointed at the gateway. In exchange, coverage does not depend on which platform produced the call. An agent that lives inside a SaaS platform and never calls out is a place Noma's API route reaches and a gateway does not.
Who decides, and who the agent is
Both products can hand a decision to a person. Noma routes a risky action to a human for approval with an audit trail; its pages do not describe how the approver is verified or how long an approval stays valid. In Smartflow, the action pauses as an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts.
The sharper difference is the agent's own identity. Noma ties each agent to its human owner and IdP group, which answers who is responsible for it. On SaaS platforms, in Noma's words, an agent "takes on its maker's identity and permissions," and Noma maps each agent to the human who built it and the permissions it inherited. Issuing the agent a credential of its own is not documented. AIDA issues a cryptographic credential to the agent itself, scoped and revocable independently of its launcher. An agent can be shut off without disabling an employee, and a supervision record under FINRA Rule 3110 names the acting entity.
Where it runs, and what an examiner gets
Noma states support for both on-premises and SaaS deployments, which gives a regulated firm a path to keep it inside its own environment. Air-gapped operation is not documented. Smartflow is designed to run air-gapped: configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else.
Noma maps governance posture to NIST AI RMF, the EU AI Act, ISO 42001, OWASP and MITRE ATLAS, and gives auditors "evidence of how agents behaved and how your policies responded." That is a strong mapping for the frameworks a CISO reports against. FINRA, HIPAA and SOX are not documented as product mappings. Smartflow generates examination packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act from enforcement records, and each record is hash-chained, time-stamped under RFC 3161 and written to the customer's SIEM. An organization with both obligations should ask each vendor for a sample.
Where Noma Security is strong
Noma covers more of the agent estate than a single gateway can. It discovers agents, MCP servers, skills and models across endpoint, SaaS and cloud, reaches SaaS agents through platform APIs with nothing to deploy, and finds endpoint agents through the EDR or MDM already installed. Its runtime detection judges each action against the full session, which is how it catches what Noma calls the lethal trifecta: untrusted input, sensitive data access and an external send, each fine alone. Steer and killswitch sit beside block, mask and human approval.
AI Red Teaming runs multi-turn attack campaigns, including in CI/CD, and feeds findings into AI-DR runtime policies. Noma's trust center lists SOC 2 Type II, ISO 27001 and ISO/IEC 42001 as active. Noma reports a Market Shaper placement in the 2026 Gartner Emerging Market Quadrant for AI Application Security, Start-Up Vendors, and was named to the 2026-27 Fortune Cyber 60. For an enterprise whose first problem is finding and controlling agents across SaaS platforms, laptops and cloud, Noma is a serious answer.
When to choose Smartflow
- One enforcement point: policy evaluated inline on every model call and MCP tool call routed through the gateway, before it executes, from any origin
- Air-gapped operation: configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else
- Agent identity: a scoped, revocable credential held by the agent itself, where the audit record still names the person who authorized it
- A person decides, on the record: the action pauses, the approver re-verifies with step-up, and the record is hash-chained and time-stamped under RFC 3161, with examination packages for FINRA 3110, HIPAA, SOX and the EU AI Act
Common questions
Does Noma Security enforce policy at runtime? Yes. AI-DR can block an action, mask sensitive data inline, steer the agent, alert a human, route the action for approval or trigger a killswitch. Noma notes that the actions available depend on the integration.
Is Noma an AI gateway or proxy? No, by Noma's own description: "No new gateways, no re-architecting for security." Noma delivers decisions through the AI gateways, MCP gateways, agent hooks, agent SDKs and direct APIs already in a company's environment. In June 2026 it announced a partnership with Kong that embeds its AI-DR in Kong AI Gateway. Model routing, failover and caching are not documented as Noma capabilities.
Can Noma run on-premises? Noma states support for both on-premises and SaaS deployments. Air-gapped operation is not documented.
Does Noma give agents their own identity? Noma treats every agent as an identity in the organization and ties it to its human owner and IdP group. Issuing a credential to the agent is not documented.
Does Smartflow need traffic routed through it? Yes. Applications and agents call the gateway, so a call has to be pointed at it. In exchange, the control sits on the path the call takes, whatever platform produced it.
Related reading
AI control plane guide · Agent governance · AIDA agent identity guide · Step-up approval for AI agents · MCP security · Tool poisoning · Examination readiness · Air-gapped AI deployment · Smartflow vs. Onyx Security · All comparisons
Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.
Noma Security sources: noma.security, /platform, /platform/saas-agents, /platform/endpoint-agents, /platform/homegrown-agents, /products/ai-dr, /products/agent-access-control, /products/ai-spm, /products/ai-red-teaming, /solutions/agent-behavior-runtime-control, /solutions/agent-control-plane, /solutions/agentic-identity, /solutions/mcp-security, /solutions/ai-compliance, /gartner/2026-gartner-market-quadrant, /blog/noma-named-to-the-2026-27-fortune-cyber-60, /blog/noma-partners-with-kong-to-secure-the-agentic-ai-era, /blog/operationalizing-iso-iec-42001-how-to-generate-continuous-technical-evidence-for-ai-governance-and-compliance, and trust.noma.security.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs