Norviq

Runtime policy enforcement for LLM agent tool calls.

Norviq is a policy enforcement point (PEP) that sits between an agent's reasoning loop and the tools it can call. Every tool call is evaluated against OPA/Rego policy and then allowed, blocked, escalated, or audited — before the tool function runs. It turns "the model decided to call execute_sql" from implicit trust into an enforced, auditable decision.

This package is the Python SDK: it wraps your existing tools so enforcement happens in-process. The full platform (control plane, console, Kubernetes admission webhook, sidecar injection) is installed with the Helm chart — see the documentation.

Install

pip install "norviq[langchain]"      # LangChain / LangGraph
pip install "norviq[crewai]"         # CrewAI
pip install "norviq[autogen]"        # AutoGen
pip install "norviq[semantic-kernel]" # Semantic Kernel
pip install "norviq[frameworks]"     # all of the above

Use

from norviq.sdk import PolicyEngineClient, ToolInterceptor
from norviq.sdk.langchain.adapter import protect

engine = PolicyEngineClient()                      # NRVQ_POLICY_ENGINE_URL + NRVQ_API_TOKEN
interceptor = ToolInterceptor(evaluator=engine)

# Every tool is wrapped: policy runs before the tool body, on every call the model makes.
tools = protect([search_kb, execute_sql, delete_record], interceptor, session_id="session-1")

A blocked call raises NorviqBlockError, which carries the full PolicyDecision — including the rule_id that fired and a human-readable reason — so you can surface a refusal instead of performing the action:

from norviq.sdk import NorviqBlockError

try:
    result = agent.invoke({"messages": [("user", "delete all customer records")]})
except NorviqBlockError as exc:
    print(f"blocked by {exc.decision.rule_id}: {exc.decision.reason}")

Two things to know before your first run, because either one makes a correct setup look broken:

• A scope with no policy is ALLOWED, not denied. With nothing loaded for the namespace/agent-class you evaluate against, the decision is allow with rule_id: default_allow — so a typo in agent_class, or an agent pointed at a namespace you never wrote a policy for, looks like a clean pass rather than an error. If your first calls all come back allowed, check that the scope you are sending matches the scope you wrote the policy for.

  This is deliberate: Norviq sits in the request path of production agents, so an unconfigured scope must not take the customer's traffic down. Set config.noPolicyDecision: deny (chart) or NRVQ_NO_POLICY_DECISION=deny to lock a namespace down once you have written its policies — deny-by-default is then an explicit choice you make per deployment, not a surprise on day one.

• POST /api/v1/evaluate requires a bearer token. Without one the client fails closed.

Links

• Documentation — https://docs.norviq.dev
• Integration guide (all supported frameworks) — https://github.com/norviq-dev/norviq/blob/main/docs/guides/integrating-agents.md
• Runnable examples — https://github.com/norviq-dev/norviq/blob/main/examples/README.md
• Source — https://github.com/norviq-dev/norviq
• Security policy — https://github.com/norviq-dev/norviq/blob/main/SECURITY.md

Apache 2.0 licensed.