Novance is the policy, security, and compliance layer between your AI agents and every payment they make — so a replayed request, a poisoned tool, or a runaway budget never becomes a real loss.
import { NovanceClient } from '@novance-labs/sdk';
const novance = new NovanceClient({ apiKey: process.env.NOVANCE_API_KEY });
// Before every agent payment — one line
const { allowed, verdict, receiptHash } = await novance.authorize({
agentId: 'agent-001',
action: { type: 'payment', amount: 250, currency: 'USDC' },
metadata: { resourceUrl: 'https://api.acme.com/data' },
});
if (!allowed) throw new Error(`Blocked: ${verdict}`);
// → 'allow' | 'deny' | 'require_approval'Built for the open agentic commerce stack
These are not theoretical. All three attack classes are documented in public security research from 2026.
A captured payment request replayed milliseconds later becomes a double-charge. Without a cryptographic nonce ledger, your agent cannot tell — and won't.
Read the docs →Agents operating on x402 can be tricked into settling payments to attacker-controlled addresses. Independent recipient verification is non-negotiable.
Read the docs →A malicious resource server response can repurpose an agent into initiating an unintended transaction. Policy gates at the authorization layer stop this before funds move.
Read the docs →Budget, time-window, and allow-list rules evaluated against the action. Fail-closed on missing policy.
DSL-based budget, time-window, and scope rules. Per-org, per-agent, per-action-type. Fail-closed on missing policy.
Replay prevention, signature verification, metadata sanitization, and composite risk scoring per request.
Parallel engine fan-out with deterministic verdict composition. Signed, hash-chained receipts on every allow.
Pre-flight attack simulation for CI integration. Catches replay, overpayment, and tool-poisoning vectors before production.
Stage-Bound Decision Trace with HMAC-SHA256 hash chain. Export NDJSON compliance evidence for SOC2 walkthroughs.
Cloudflare Workers edge deployment. Sub-10ms p99 on authorization hot path. Free tier: 10,000 authorize calls/month.
Install the SDK, call novance.authorize(), and every payment goes through the full pipeline.
import { NovanceClient } from '@novance-labs/sdk';
const novance = new NovanceClient({
apiKey: process.env.NOVANCE_API_KEY,
});
const result = await novance.authorize({
agentId: 'my-agent',
action: {
type: 'payment',
amount: 100,
currency: 'USDC',
recipient: '0xRecipientAddress',
},
metadata: { resourceUrl: 'https://vendor.com/item' },
});
if (!result.allowed) {
throw new Error(`Payment denied: ${result.verdict}`);
}Free tier is genuinely free — no credit card required, no hidden per-call fees on the first 10,000 calls.
For individual developers and open-source projects.
For teams shipping agent-powered products to production.
For orgs with compliance requirements and high call volumes.
Attested Signing Gate (Tier 1, hardware-backed) is available on Business+. Tier 0 (software-based ASG) is included on all plans. See the docs for full tier comparison.