nono: The Open Source Runtime Layer That Gives Your AI Agent Amnesia About Credentials at Exactly the Right Moment
Your AI agent needs a password to do its job. The problem is what happens after it uses it.
In almost every agentic system running today, the agent holds that credential for the entire session. It picked up the key when it started. It still has the key when it finishes. Everything it does in between happens with that key in its pocket.
That is not a model problem. It is not a prompt engineering problem. It is a design problem. And it is the one nobody fixed before AI agents existed.
nono fixes it. The agent picks up the credential at the exact moment it needs it, uses it for that one action, and forgets it ever existed before the next action begins. Not metaphorically. By design. At the operating system level. The credential is gone before the agent's next instruction executes.
In this live demo, Aleksy Siek will show exactly what that looks like on a real running system: an AI agent calling a real upstream service, retrieving a real credential from a secrets vault, completing the call, and leaving zero trace of that credential in agent-accessible memory. Then we will attempt to steal it mid-session and show you what happens.
Sal Kimmich will open with why this problem exists at all, why zero trust at the network level does not solve it, and why the enforcement unit for agentic systems has to be the individual tool call, not the session.
What nono offers
Secure, kernel-enforced sandbox CLI and SDKs for AI agents, MCP and LLM workloads. Capability-based isolation with secure key management, atomic rollback, cryptographic immutable audit chain of provenance. Run your agents in a zero-trust environment.
What you will see
A single command. A real API call. A credential that exists for exactly as long as it needs to, and not a moment longer. Then the audit trail proof: from policy to kernel, if the action was not permitted at the policy boundary, the syscall never fires. And if it does fire, you get a complete record from what the agent was permitted to do down to every kernel object access attempt and the syscall that triggered it at runtime. What the black box of runtime is allowed to do, and exactly what it does.
When the credential never exists in agent-accessible memory, there is nothing to exfiltrate.
For the technical audience
This is the confused deputy problem (Hardy, 1988) restated for agentic systems: ambient session-scoped authority is the structural predecessor to prompt injection, and per-invocation enforcement is the structural fix
Per-invocation Landlock LSM enforcement at the kernel object boundary: the deny fires before any resource is consumed
SPIFFE JWT-SVID minted per tool call, presented to a credential store via Workload Identity Federation, exchanged for an upstream API credential
Phantom token proxy: credentials held in a trust-boundary-separated supervisor process, zeroed after use, never in agent-accessible memory
Merkle-chained audit trail: SPIFFE identity (who) and Landlock capability grants (what) encoded as separate fields, produced by a process the agent cannot reach or alter
For the compliance audience
Credential non-possession as an architectural property: agents cannot exfiltrate what they never held
Blast radius bounded to the individual tool call by design, not by policy
Audit trail consistent with requirements for separating identity from authorization records
Works with existing enterprise identity infrastructure: SPIFFE/SPIRE, secret/ credential vault, Kubernetes service accounts, cloud IAM
Open source, Apache-2.0, with active standardization through the OpenSSF secure agentic framework
Who should come
Engineers building or evaluating agentic systems who want to understand where the real runtime attack surface is. Platform teams running a secrets vault or SPIFFE/SPIRE who want to see how their existing infrastructure maps to the tool call boundary. Security architects who need a concrete answer to the question: if an agent is compromised mid-session, what is the blast radius and how do we bound it?
We are looking for design partners. If you are running agentic systems in production and want to push the edges of per-invocation enforcement, come with hard questions.
Read more at nono.sh · nono.sh/blog/secure-agent-audit
With:
Sal Kimmich · Security Architect, Nolabs
Aleksy Siek · Founding Engineer, Nolabs
Tuesday, July 26, 2026 · 45 minutes · live demo and open Q&A Free to attend. Recording available to registered attendees.
nono is Open Source, Apache-2.0