Start with the boundary.
Nomiarch is an open source trust and authorization platform in development. The goal is to keep infrastructure and AI within the conditions an organization has approved.
These pages describe the proposed implementation. The project does not yet have a runnable installer or a production release. The first public runtime release is still being developed.
Choose a starting point
Architecture
How local AI, independent policy, bounded execution, and evidence fit together.
02 / THE FIRST DEPLOYMENTRunning the project
The planned VM installation path and what must be proven before a release.
What the platform is for
Platform and cloud engineers need a way to connect a security finding to a controlled change, then give reviewers evidence that the deployed state was checked. AI introduces another question: who decides what an agent is allowed to do?
The proposed platform observes an environment, reasons about deviations, authorizes permitted actions, coordinates repairs, independently checks the result, and records evidence. Policy enforcement sits outside the model.
Start narrow. Preserve the larger design.
The first scenario focuses on one Azure Storage account in a test environment in Canada Central. The target setting is allowBlobPublicAccess=false. Local AI proposes the repair; separate authorization, execution, and verification services complete the loop.
The broader vision includes conventional workloads, additional clouds and on-premises infrastructure, AI tool admission, sovereignty profiles, and disconnected deployments. These remain future directions.
The principles behind the design
- Intelligence and authority are separate. Model output alone cannot grant permission to act.
- Approval describes an exact change. A modified proposal must be evaluated and approved again.
- Deployed state is checked independently. An executor reporting success is insufficient.
- Evidence stays useful locally. The intended runtime should not depend on an external SaaS evidence service.
- Deployment conditions are explicit. A private VM, Canadian hosting, and a physical air gap provide different guarantees.
How to follow development
The roadmap separates the current design from the planned prototype and reproducible release. Installation commands will appear here only after they have been tested against a published version.
Design documentation · Updated 15 September 2026 · Nomiarch · Architecture in development.