# Scan: Noxus AI Workers

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Noxus AI Workers: freedom 1, 1, 1, 4, 1, 1, 1 across its configurations; deployment governance not assessed.
> Page: https://gamma-ray.sgit.ai/scans/noxus-ai-workers/ · Source: data/scans/noxus-ai-workers.json


Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor

Configurable agents that use flows, integration actions, knowledge bases, tables, MCP servers, code execution and a sandbox to carry out tasks, deployed through the web app, API, SDK, chat widget, Slack, Teams, Google Chat, WhatsApp or Telegram.

A scan of a product as its vendor documents it, not of any one deployment. Made by the report studio: a researcher-assessor, a challenger, then the scorer. Part of the first Portuguese cohort.

Built only from Noxus's own public pages (product, documentation, blog, customer stories, legal and security pages). Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated.

*Figure. The label for this rating; its contents are in the text.*

1 Freedom as shipped Answers 4 Freedom at most Acts widely 12 Controls it brings as shipped n/a Deployment governance not assessed

## How to read it

This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings.

*Figure. The freedom level of each configuration; the table has the same.*

| Configuration | What changes | Freedom | Controls | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | Noxus AI Workers (AI Co-workers; 'Agents' in the documentation) with its documented defaults. | 1 Answers | 12 | nothing |
| **Code exec** | Code Execution tool turned on for the agent | 1 Answers | 12 | it generates and executes code with local or cloud privileges |
| **Sandbox** | Sandbox tool turned on for the agent (persistent Syd sandbox) | 1 Answers | 13 | a limit on it is enforced by something outside its own reach |
| **Hitl** | Human in the Loop tool or Require Approval turned on for the agent | 4 Acts widely | 13 | the agent works independently; the person approves critical decisions only; high-impact actions need a person's approval |
| **Bot identity** | Agent deployed under a service account or app-only identity rather than a user's OAuth | 1 Answers | 13 | it has its own identity, separate from any person's |
| **Obs feedback** | Phoenix or Langfuse observability provider connected, enabling user feedback on responses | 1 Answers | 13 | there is a channel to report problems with it or contest its output |
| **Actions** | Integration actions (single integration nodes, such as Send Email or Delete OneDrive File) selected as tools for the agent | 1 Answers | 12 | it works across several domains or systems |

The same product is a different agent in each row. A rating of a deployment starts by saying which row it is.

An indicator with no evidence is reported as not evidenced; it is never read as a no.

## The profile

*Figure. One square per indicator, by question; every answer is listed below.*

## The grant: what it can actually do

The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given.

**Not measured.** Not measured. No deployment shape for this product is published in the capability grammar.

## Seen, and not credited

- Public Stop Run endpoint (POST /v1/runs/{run_id}/stop) as the source for I39 Its response schema is a workflow run (workflow_id, node_ids), so it stops a flow run, not an agent; the deactivate-deployment source is kept with its narrow note. [Source](https://docs.noxus.ai/api-reference/v1--runs/public-stop-run)
- I12 or I13 (coordinates other agents) from the multi-agent mention One sentence on what-is-noxus says the tools can be composed into multi-agent environments; it does not document an agent coordinating other agents. [Source](https://docs.noxus.ai/core/what-is-noxus)
- The integrations catalog as the source for I10 It lists connector suites the platform offers, not one agent working across systems; I10 now rests on the agent tools page, where actions from several systems are given to one agent. [Source](https://docs.noxus.ai/integrations/catalog)

## What its evidence reaches

*Figure. The mashup graph with this agent's evidenced indicators lit.*

## Every answer, with its source

### What is the agent built on?

- *Not evidenced.* It is a vendor's assistant, used as supplied.
- *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code.
- **As shipped.** It is configured on a low-code or no-code builder and acts on real organisational data. Agents and flows are configured in a visual builder without code, and agents search knowledge bases built from the organisation's documents and data. [Source](https://docs.noxus.ai/core/what-is-noxus) (documented)
- **Available, if the operator turns it on.** It generates and executes code with local or cloud privileges. With the Code Execution tool turned on, the agent writes and runs code. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries.

### Does it act, or only answer and recommend?

- *Not evidenced.* It follows fixed rules, with no reasoning.
- *Not evidenced.* It retrieves information and recommends actions; a person acts.
- **As shipped.** It executes actions itself. Agents use tools and run flows to take actions themselves. [Source](https://docs.noxus.ai/platform/agents/introduction) (documented)
- **As shipped.** It is in production: a public source names a customer or gives usage figures for what it does on its own. A named customer, CUF, reports patient communications processed by the AI Worker each month. [Source](https://www.noxus.ai/case-studies/cuf-healthcare) (documented)

### How far does it reach?

- *Not evidenced.* It works in one domain's data.
- **Available, if the operator turns it on.** It works across several domains or systems. The tools page states one agent can be given integration actions as tools, such as Send Email, Create Google Drive Sharing Link or Delete OneDrive File, alongside flows, knowledge bases and database connections. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- **As shipped.** It connects to external tools or services across a trust boundary. An agent can be bound to external MCP servers and call their tools. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)

### Does it work with other agents?

- *Not evidenced.* Several agents coordinate inside the organisation.
- *Not evidenced.* Agents operate across organisational boundaries or disparate stacks.
- *Not evidenced.* There is a published protocol or communication layer between agents.
- *Not evidenced.* Others build on it: third parties publish integrations, skills or agents for it.
- **As shipped.** It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call. A hosted MCP server lets external clients and agents call Noxus agents, conversations and workflows as tools, authenticated with a workspace API key whose permissions gate the tools. [Source](https://docs.noxus.ai/sdk/mcp/overview) (documented)

### What is the person's role?

- *Not evidenced.* The person operates: every action is prompted and controlled by them.
- *Not evidenced.* The agent suggests; the person reviews and approves each action.
- **In this deployment.** The agent handles routine tasks; the person is consulted on exceptions. At CUF the AI Worker processes patient messages and routes complex cases to staff. [Source](https://www.noxus.ai/case-studies/cuf-healthcare) (documented)
- **Available, if the operator turns it on.** The agent works independently; the person approves critical decisions only. The tools page documents a Human in the Loop tool an agent owner may enable, under which the agent escalates to a person to get approval for critical actions; it does not say how any given agent is shipped. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- *Not evidenced.* The agent has full autonomy within boundaries; the person monitors.

### Is what it is for written down?

- **As shipped.** Its purpose and permitted tasks are stated in writing. The company states the agents' purpose: handling complaints, documents and tickets. [Source](https://www.noxus.ai/aboutus) (documented)
- **As shipped.** Its autonomy limits and the tools it may use are defined. The builder selects which actions and flows each agent may call. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- **As shipped.** Its limits and known failure cases are documented for those who use it. The tools page documents limits, such as web research being less reliable than knowledge bases. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)

### Does it have its own identity and only the access it needs?

- **Claimed, not counted.** What it can reach is enumerated: scopes, permissions, tools. Each agent's tools are an enumerated list chosen by the builder: the flows, actions, knowledge bases, database connections and MCP servers it may use. [Source](https://docs.noxus.ai/platform/agents/tools) (documented; this fact has to be observed or measured to count)
- *Not evidenced.* Its authorisation is published as metadata that anyone can read.
- **As shipped.** It asks for narrower access than the whole account. Each agent reaches only the flows, actions, knowledge bases and database connections selected for it; its SQL is generated read-only and runs with that connection's privileges, and tables are read-only unless edits are allowed. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- **Available, if the operator turns it on.** It has its own identity, separate from any person's. A Google Chat deployment can run under a service account bot identity separate from any person. [Source](https://docs.noxus.ai/platform/agents/deployments/google-chat) (documented)
- *Not evidenced.* Its identity is cryptographic and can be checked by others.
- *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on.

### Is it in a registry, with an owner?

- *Not evidenced.* The organisation keeps a registry of its agents.
- *Not evidenced.* Each agent has a named owner.
- *Not evidenced.* Agents are retired by a defined process.

### Who is accountable for it?

- *Not evidenced.* A named executive or body is accountable for the organisation's agents.
- *Not evidenced.* Roles and responsibilities for AI risk are documented.

### Is there a policy that governs it?

- *Not evidenced.* A governance policy for agents is published.
- *Not evidenced.* Agents and use cases are classed by risk.
- *Not evidenced.* The laws that apply to it are identified.
- *Not evidenced.* New agents pass an approval or review before they run.

### Can a person step in or stop it?

- **Available, if the operator turns it on.** High-impact actions need a person's approval. The Human in the Loop tool and Require Approval make the agent ask a person before actions run. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- **As shipped.** There is a way to pause or stop it. An agent's deployment on a channel can be deactivated through the API. [Source](https://docs.noxus.ai/api-reference/v1--deployments/deactivate-deployment) (documented)
- *Not evidenced.* There is a defined escalation path.

### Is what it does logged?

- **Claimed, not counted.** Its actions are logged. Logs record agent interactions including tool calls and reasoning steps, with run-level logs per run. [Source](https://docs.noxus.ai/deployment/operations/logging) (documented; this fact has to be observed or measured to count)
- *Not evidenced.* The log is tamper-evident and kept for a stated time.

### Is it watched while it runs?

- *Not evidenced.* It is monitored in operation.
- *Not evidenced.* Anomalies are detected in real time and raise alerts.

### What stands between it and what it should not do?

- **Available, if the operator turns it on.** A limit on it is enforced by something outside its own reach. When the sandbox is on, a Syd sandbox outside the agent blocks internal network ranges and requires the sandboxes:run permission. [Source](https://docs.noxus.ai/platform/agents/sandbox) (documented)
- *Not evidenced.* A limit on it is a setting that its own account could change.
- **As shipped.** A limit on it is a rule in prose. Instructions written in prose set allowed behaviour and restrict access. [Source](https://docs.noxus.ai/core/concepts/agents) (documented)
- *Not evidenced.* Policy is enforced as machine-readable rules.
- *Not evidenced.* The difference between what it can reach and what it is for is stated.

### Is it tested, and are the results shown?

- *Not evidenced.* Test or evaluation results are published.
- *Not evidenced.* It is tested for safety and security, including by attack.
- *Not evidenced.* People who did not build it take part in assessing it.

### What happens when it goes wrong?

- *Not evidenced.* There is an incident process for agents.
- **As shipped.** Incidents and errors are communicated to those affected. A public status page posts incidents and offers incident update subscriptions. [Source](https://status.noxus.ai/) (documented)
- *Not evidenced.* There is a plan for a failure of a third party it depends on.

### Do people know it is an AI, and can they answer back?

- *Not evidenced.* It tells the people it talks to that it is an AI.
- **Available, if the operator turns it on.** There is a channel to report problems with it or contest its output. With a Phoenix or Langfuse provider connected, users can rate agent responses up or down. [Source](https://docs.noxus.ai/core/infrastructure/observability-providers) (documented)
- **As shipped.** It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. An OpenAPI 3.1.0 description of the backend API resolves; the docs llms.txt also resolves. [Source](https://backend.noxus.ai/openapi.json) (observed)

### What data does it use, and under what rules?

- **As shipped.** The data it uses is described. The tools page describes the data an agent can use: knowledge bases, connected databases queried read-only, and workspace tables. [Source](https://docs.noxus.ai/platform/agents/tools) (documented)
- *Not evidenced.* There are data quality rules for what it reads.
- *Not evidenced.* Its privacy risk has been examined.

### What does it depend on from others?

- **As shipped.** The models and third-party components it uses are listed. The model providers and model families an agent can use are listed. [Source](https://docs.noxus.ai/core/infrastructure/models-providers) (documented)
- *Not evidenced.* Third-party components are monitored and have risk controls.

### Has anyone independent checked?

- *Not evidenced.* A public certificate or audit report covers it.
- *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator.

### Is the organisation behind it ready?

- *Not evidenced.* There is a stated strategy for agents.
- *Not evidenced.* The people who work with it are trained.
- *Not evidenced.* Its value is measured.
- *Not evidenced.* It is improved on a regular cycle.
- *Not evidenced.* The organisation's risk management covers agents.

## The vault

This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`6n9a4tow`, published 2026-11-10). Anyone can read it with this key:

`sgit_public_read_eafc52a9cbd090f15069febc32ea08d2630b1aa8410e8b8bc4cc5f4b3f197e98:6n9a4tow`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_eafc52a9cbd090f15069febc32ea08d2630b1aa8410e8b8bc4cc5f4b3f197e98:6n9a4tow`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.