Token Observe vs Noma Security

The control point itself. Traffic passes through one process and eleven ordered steps run in it — authenticate, resolve agent, open trace, sanitise, scan, govern, enact, route, call upstream, govern the response, meter and record.

One environment variable. For supported OpenAI-compatible, Anthropic and Gemini ingress, changing OPENAI_BASE_URL or ANTHROPIC_BASE_URL and one key is normally the whole integration, plus one Streamable HTTP endpoint for MCP.

The payload itself, in a fixed order: Unicode sanitisation first, then eleven sensitive-data classes of which three are checksum-validated, then nine weighted injection heuristics scored 1.25× higher when the text arrived as a tool result.

Six first-class upstreams — OpenAI, Anthropic, Gemini, OpenRouter, Bedrock and Azure OpenAI — under identical policy, redaction, budgets and tracing, with that equivalence enforced by a table-driven parity test over every provider kind.

One endpoint in front of every registered upstream server. Tools reach an agent namespaced and filtered to its grants, every call is re-authorised at execution rather than trusted from the listing, and each descriptor is hashed at approval so an upstream rewrite quarantines the tool until a human approves it again.

Not governed. A shadow-AI radar reconciles five evidence sources — vendor bills, network egress, service-account key audits, IDE and CLI telemetry, and Token Observe’s own caller and price consistency checks — into findings for a risk register, and chasing those agents down inside your organisation is your work.

Five policy actions resolved to one verdict — block, require approval, redact, warn, suspend the agent — with a fixed precedence in which a block beats an approval and an approval beats a redaction.

Seven typed trigger kinds: the tool being called and its argument values, the model requested and its estimated input size, accumulated spend, request and token rate, detected data classes, the injection score and the source the text came from, and the hour of day in UTC.

Deny-by-default and action-level. An action no role names is refused, an explicit deny beats every allow wherever it is written, and a delegation chain intersects rather than unions, so a low-privileged agent gains nothing by routing work through a higher-privileged one.

Bound to the SHA-256 of the canonicalised action plus the execution context it was proposed in, single-use through a compare-and-set so two concurrent retries cannot both execute, and expiring — 60 minutes by default, one minute to seven days by policy. Change one argument and the hash no longer matches, so the retry is refused as a mismatch rather than allowed as near enough.

Hard USD ceilings per request, per rolling hour, per UTC day and per UTC month, reserved before egress in a single per-agent transaction, alongside requests, tool calls and tokens per minute. A budgeted agent whose resolved route or fallback cannot be priced is refused with a 409 before egress rather than priced at zero.

Every rule can run in shadow mode first, recording what it would have done without stopping anything. Where the deployment turns the gate on, no rule may begin enforcing until a backtest of that exact rule has been replayed against recorded traffic and acknowledged by a named person.

A kill switch scoped to one agent, one team or the whole estate, checked first in the pipeline — ahead of lifecycle status, permissions, budgets and policy — so it reaches even the routes that execute nothing.

Evidence about one request. The flight recorder holds the post-redaction prompt excerpt, the tool calls and their arguments, the policy decisions, the human approvals, the tokens and the cost, in a timeline that explains each step in a plain sentence rather than a log line.

A hash chain in which each entry’s digest covers the previous entry’s hash plus the canonical JSON of its own content, so an edit or a deletion breaks verification at a named sequence number. It is tamper-evident, not tamper-proof, and the default is unkeyed SHA-256 that an operator with write access can rewrite and recompute — the repository ships a forgery test asserting exactly that.

A compliance officer’s question in English is translated into a validated filter object over fourteen allow-listed fields — never into SQL, because trace content is attacker-influenced by construction — and the interpreted filter comes back as editable chips. It degrades to a deterministic keyword parser when no model answers, and it cannot group, count or correlate across traces.

An export sealed with a SHA-256 digest over canonical JSON and carrying the audit chain’s verdict. It is digest-sealed and not signed; durable origin evidence comes from the keyed chain plus an Ed25519 anchor retained independently of the database.

Trace retention is unset by default, and unset means keep forever. That is a decision left to you rather than made for you, and it is the wrong default for anyone who has not made it deliberately.

Self-hosted only. One Node process, one SQLite file, on a host you run; there is no vendor-hosted tier to choose instead, which is a constraint as often as it is a feature.

Governed payloads leave only for the model and tool providers you configure, after policy and redaction. The vendor receives no product telemetry, no phone-home data, no prompts, no keys and no trace database, and the runtime data flow is documented so a reviewer can verify that rather than take it on assurance.

None. No SOC 2, no ISO 27001, no ISO 42001 and no independent penetration test. Stated on the first call rather than under questioning, and if a certification is your gate the comparison ends on this row.

Fail-closed and in the path: if Token Observe is down, governed agents cannot call models, and there is no replica, no clustering and no vendor uptime commitment at its current target scale. The endpoint hook is built the opposite way for the opposite reason — it decides locally against an Ed25519-signed policy bundle and makes no network call at all, because every vendor hook fails open on timeout and a hook that round-tripped would turn each slow VPN into a silent org-wide bypass.

No published price list either. The commercial arrangement is discussed rather than looked up, which is a real disadvantage in a procurement process that starts with a budget line.

One component with a narrow surface. Its optional modules default off — audit anchoring, policy backtesting, on-behalf-of intersection and radar scheduling each require an operator to switch them on — so an upgrade changes no behaviour until somebody decides it should.

Commercial source-available: use, modify and self-host under a licence, with redistribution and offering it as a competing hosted service excluded, and security research and publication of results expressly permitted. The licence file is a template pending review by counsel rather than an executed grant.

A published support model with severity definitions and response targets, and a plain statement of why there is no availability SLA yet: the vendor does not operate your deployment and has no telemetry from it, so an uptime number from a party with access to neither would be unmeasurable by both sides.

A 30-day evaluation written so your security team may read, run and attack the software before a purchase order is raised, with no gag clause and no pre-approval of results — under the template licence above, alongside a published defect list and a published residual-risk register.