The action
- identity
- support
- tools
- 3 declared
- source
- connector
- status
- ready
Capabilities
One way to touch the world.
Built-ins, your code, and connected systems all become the same thing: a typed action with a live grant, a defined execution boundary, and a durable trail.
Capability call · support.create_ticket decision preview
Invocation pointagent
calling principal agent:support-triage conversation · 01J9K4
surfaceagent
autonomysupervised
grant● active now
calls→declared input
Capabilityconnector
namespace support OAuth connected
toolcreate_ticketrisk · act inputticket.request.v1schema sourceZendeskremote MCP
admits→live policy
The door● evaluating
01Grantbound · current
02Floorno denial
03Policyact needs a person
decisionPAUSEheld durably for approval
ALLOWexecutor receives proofthe call may run
PAUSEhold without guessingresume once resolved
DENYexecutor stays unreachablereason recorded
The unit
Not a tool list. A contract for an effect.
A Capability gives an action a stable identity, a declared interface, and somewhere to execute. It may expose one tool or a whole family of them.
The Capability says what can be called. A binding says who may call it. The invocation point supplies the policy for this call. Keeping those separate is what makes one resource safely reusable.
support.create_ticketthree separate concerns
The grant
- resource
- cap:support
- principal
- agent:triage
- state
- active
- checked
- call time
The posture
- surface
- agent
- level
- supervised
- tool tier
- act
- answer
- pause
same Capabilitydifferent bindingsdifferent policy at each front door
Three sources
Build it. Connect it. Or use what is already here.
Source changes how an action is implemented—not how it is granted, invoked, governed, metered, or traced.
01 · built-ins●
Platform primitives
Files, search, retrieval, memory, HTTP, browsers, code execution, sandboxes, Computers, and tools for extending the system itself.
web_searchfilesmemorycomputer
maintained by Noorle02 · plugins▲
Your logic
Package customer code as versioned, permissioned WebAssembly. Its declared tools run inside an isolated in-process sandbox.
refund_policyv4 active2 tools
portable logic · controlled runtime03 · connectors◇
External systems
Bring remote MCP services or REST/OpenAPI operations. Keep credentials encrypted and complete managed OAuth where the provider supports it.
remote MCPRESTOpenAPIOAuth
registry or custom endpointdifferent implementation→one Capability contract→one governed call path
One governed path
The source changes. The door does not.
Every side-effecting capability call reaches one admission point. The door combines the current grant, a code-level floor, and the policy of the surface that invoked it.
Admission trace · 14:22:08.441 three calls · three answers
builtin · readfiles.read/workspace/order.pdf
agent · read onlygrant activerisk · read
admit
ALLOWexecute with proof
connector · actsupport.create_ticketpriority · urgent
agent · supervisedgrant activeperson on the wire
admit
PAUSEhold durably
connector · actpayments.refundamount · $240
gateway · supervisedgrant activeunattended caller
admit
DENYwould need approval
no executor before admissionno human on the wire: would-pause becomes deny
Execution sits behind the door.
An allowed call carries the admission proof the executor requires. A denial never reaches it.
There is a floor no admin can soften.
Account and surface policy can narrow authority, but cannot negotiate below the code-level floor.
A pause is a real state.
It survives a restart, waits for a person, and resumes the held call once the decision is resolved.
Execution boundaries
Match the environment to the work.
A tiny business rule, a disposable operating system, and a long-lived desktop should not share one runtime. Noorle makes the boundary explicit.
01 · in-process WASMsandboxed
Compact customer logic
Versioned plugins run in an isolated in-process sandbox and expose only their declared tools.
fast start · permissioned package02 · Sandboxdisposable
Isolated machine work
Use a disposable Linux environment when the task needs an operating system, files, and processes.
ephemeral boundary · session work03 · Computerpersistent
A machine an Agent owns
Keep a durable environment for stateful, interactive work. A Computer stays Agent-bound.
persistent state · Agent only◇Connectorthe executor is an external system
→Noorle still owns the capability contract, encrypted authentication, admission decision, and trail around the call—even when the work runs elsewhere.
The standard library
Primitives for real work.
Bind only what the job needs. Every first-party Capability enters through the same grant, policy, journal, and meter as the ones you add.
01 · information●
Web Search
Search the open web from a run.
read02 · information→
Knowledge Retrieval
Hybrid search and reranking over indexed documents.
read · explore →03 · information●
Browser
Render pages, extract content, and capture artifacts.
act04 · data●
Files
Read and write session files and working artifacts.
read + act05 · data●
HTTP Client
Make direct HTTP requests from a run.
act06 · state●
Memory
Store, recall, and forget curated facts across conversations.
read + act07 · compute●
Code Runner
Run code for analysis and transformation.
act08 · compute●
Sandbox
Use a disposable Linux environment for isolated work.
privileged09 · compute●
Computer
Give one Agent a persistent machine it can return to.
privileged · Agent only10 · authoring●
Plugin Builder
Create and version new action packages from inside Noorle.
privileged · deliberately granted11 · authoring●
Skill Builder
Create and refine reusable guidance from real work.
privileged · deliberately grantedbeyond built-ins+
Add the missing verb.
Connect an existing system or package the logic as a plugin.
same contract · same doorReusable by design
One Capability. Four ways to put it to work.
Reuse the action without collapsing the trust boundaries around it. Each consumer keeps its own operating semantics.
01 · Agent
Give a principal a verb.
Bind a Capability to an Agent, then let that Agent decide when the job calls for it.
stable conversation surface → 02 · ProgramCall it inside control flow.
A one-off Program run can use Capabilities already bound to the Agent that started it.
run once in the current turn → 03 · WorkflowPublish it as a dependency.
A published Workflow names its own resources so durable Runs never depend on the author’s tool surface.
explicit binding contract → 04 · GatewayExpose it through MCP.
Compose selected Capabilities behind a dedicated endpoint, audience, and autonomy policy.
current bindings per request →Skillguides judgment
·Programorders the work
·Capabilityperforms the action
Give the work a governed way out.
Build it · connect it · bind it · let the door decide