--- title: "Norcaster Docs — AI Runtime Control Plane documentation" description: "Documentation for Norcaster, the AI Runtime Control Plane: quickstart, architecture, Boundary runtime protection, policies, observability, evals, retrieval, and self-hosted setup." canonical: https://www.norcaster.com/docs --- # Norcaster Documentation Norcaster is the AI Runtime Control Plane for production AI systems. Deploy, control, observe, and evaluate AI workflows from one runtime layer. ## Start here The shortest path to understanding the AI Runtime Control Plane and getting a request through it. [ ### What is Norcaster? Plain-language overview of the AI Runtime Control Plane, the four pillars, and how Norcaster differs from gateways, evals, and observability tools. Open →](https://www.norcaster.com/docs/overview)[ ### AI Runtime Control Plane Concept page: the runtime layer in the request path versus the control plane for configuration, and how the two surfaces work together. Open →](https://www.norcaster.com/docs/control-plane)[ ### AI gateway vs runtime control plane What a gateway does, what a runtime control plane adds — policy before inference, per-request evidence, budget gates, evals — and how Norcaster includes a gateway as its ingress. Open →](https://www.norcaster.com/docs/ai-gateway-vs-runtime-control-plane)[ ### Quickstart Get a real request flowing through the runtime in a few minutes — without an ML background. Open →](https://www.norcaster.com/docs/start)[ ### Architecture Request lifecycle, managed vs self-hosted deployments, data flow, and what Norcaster stores. Open →](https://www.norcaster.com/docs/architecture)[ ### Runtime protection (Boundary) How policy runs before the model on /run and /v1/\* gateway routes, contextual packs, and where to set org, project, and deployment defaults. Open →](https://www.norcaster.com/docs/boundary-readiness)[ ### Boundary pricing Starter / Team / Enterprise limits, protected-flow definition, and what is enforced in the API vs contact-led packaging. Open →](https://www.norcaster.com/docs/boundary-pricing)[ ### Public sandbox quick test Run Boundary against curated prompts in a browser-first sandbox before signup. Fastest way to see allow/redact/block outcomes. Open →](https://www.norcaster.com/boundary/sandbox) ## Product & integrations [ ### Deployments Turn workflows, models, retrieval, and tools into production-grade deployments. Manage revisions, environments, and rollouts. Open in dashboard →](https://www.norcaster.com/dashboard/deploy)[ ### Self-hosted setup Run the API, portal, orchestrator, and cluster infrastructure in your environment when data residency and network boundaries require it. Read more →](https://www.norcaster.com/docs/self-hosted-setup)[ ### Templates Start from concrete outcomes—safer chat, document Q&A, approvals—not blank graphs. Read more →](https://www.norcaster.com/templates)[ ### Workflows Workflow + MCP guide: input normalization, redaction chains, model/agent prompt fields, functions, retries, approvals, and routing. Read more →](https://www.norcaster.com/docs/workflows)[ ### Runtime Layer Extraction (BYO model) Wrap input and output policy around a model you host elsewhere via the external\_model workflow node — one auditable trace, no re-platforming. Read more →](https://www.norcaster.com/docs/runtime-layer-extraction)[ ### Workflow setup examples Concrete graph recipes for ticket analysis, CRM summaries, native agents, functions, knowledge lookup, approvals, policy gates, and model fallback. Read more →](https://www.norcaster.com/docs/workflow-examples)[ ### Deploy multi-model workflows Step-by-step guide for multi-model workflows with model roles, native agents, functions, provider-backed deployments, tools, routing, policies, and evals. Read more →](https://www.norcaster.com/docs/multi-model-agents)[ ### Runtime policies Schema enforcement, PII/payment blocking, budget gates, allow/block/redact decisions, packs, CLI, and API. Read more →](https://www.norcaster.com/docs/policies)[ ### Budget control Cap AI cost and usage at runtime with request ceilings, compute limits, retry controls, and agent/tool safeguards. Read more →](https://www.norcaster.com/docs/budget-control)[ ### Boundary enforcement Practical setup guide for schema validation, guardrails, budgets, and audit evidence at the request path. Read more →](https://www.norcaster.com/docs/boundary-enforcement)[ ### Governed chat widget Script embed, React/Vue/Svelte npm packages (@norcaster/chat-\*), browser keys, and CORS for site widgets. Read more →](https://www.norcaster.com/docs/chat-widget)[ ### Knowledge & docs Answers from your own documents—chunking, embeddings, and sources (document lookup; also called RAG). Read more →](https://www.norcaster.com/docs/knowledge)[ ### Deploy a RAG model Step-by-step guide: connect providers, create a knowledge base, ingest docs, test retrieval, build a workflow, and audit results. Read more →](https://www.norcaster.com/docs/rag-deployment)[ ### Retrieval integrations Vector backends (pgvector, Pinecone, Weaviate, Qdrant) and semantic search APIs. Read more →](https://www.norcaster.com/docs/retrieval)[ ### Evals — quality checks Quality checks run outside the agent against a versioned reference. Suites, regressions, scoring an existing run, and how verdicts tie into deployments and traces. Read more →](https://www.norcaster.com/docs/evals)[ ### Quality checks workspace Golden datasets and side-by-side comparisons inside the dashboard. Open in dashboard →](https://www.norcaster.com/dashboard/evals)[ ### Observability Trace every request, model call, tool call, policy decision, and eval result in one timeline. Read more →](https://www.norcaster.com/docs/observability)[ ### Provider integrations Anthropic, OpenAI, Azure OpenAI, Bedrock, Groq, Together, Voyage AI, credentials, and provider-backed inference targets. Read more →](https://www.norcaster.com/docs/providers)[ ### Pricing, usage, and limits Plan concepts, usage drivers, managed vs self-hosted costs, budget gates, and audit export expectations. Read more →](https://www.norcaster.com/docs/pricing-limits)[ ### CLI norcaster deploy, run, status. Full command reference with options and examples. Read more →](https://www.norcaster.com/cli)[ ### API Reference REST API documentation. OpenAPI spec. Deploy, run, status, usage. Open API docs →](https://api.norcaster.com//docs) ## Advanced runtime control & contracts For teams tightening enforcement and schema contracts after the basics feel familiar. [ ### Contracts Schema and feature contracts. Versioned, strict by default. Read more →](https://www.norcaster.com/docs/contracts)[ ### Runtime guarantees What the runtime layer promises: retry limits, rate control, validation rules, compute ceilings, audit exports. Read more →](https://www.norcaster.com/docs/runtime-guarantees)[ ### Troubleshooting Fix common deployment, provider, MCP, model prompt, redaction, and portal dev issues. Read more →](https://www.norcaster.com/docs/troubleshooting) ## Platform [ ### Security & compliance MFA, SSO/OIDC, signed audit exports, GDPR rights, data flow, ownership, hosting, and provider boundaries. Read more →](https://www.norcaster.com/docs/security-compliance)[ ### EU AI Act readiness Supported runtime paths, evidence APIs, customer checklist, and approved readiness wording (not legal compliance). Read more →](https://www.norcaster.com/docs/eu-ai-act-readiness)[ ### Obligation frameworks One evidence base, many standards: EU AI Act, SOC 2, DORA, NIST AI RMF, ISO/IEC 27001, ISO/IEC 42001, GDPR, HIPAA, PCI DSS, RBI FREE-AI and India DPDP views — honesty-tagged rows, stated out-of-scope areas, draft status until validated. Read more →](https://www.norcaster.com/docs/frameworks)[ ### AI governance & evidence FAQ Direct answers: can software do your SOC 2, what evidence Norcaster produces, Vanta/Drata coexistence, and independent verification. Read more →](https://www.norcaster.com/docs/faq)[ ### Norcaster with Vanta, Drata, or Secureframe Readiness platforms evidence the organization; Norcaster evidences the AI runtime slice they cannot see. Two evidence surfaces, one audit. Read more →](https://www.norcaster.com/docs/norcaster-and-readiness-platforms)[ ### SOC 2 runtime evidence Runtime evidence for the AI slice of a SOC 2 examination: honesty-tagged criterion mapping and verifiable bundles. Norcaster evidences; a licensed CPA firm attests. Read more →](https://www.norcaster.com/docs/soc2-evidence)[ ### Article 26 AI Register Understanding the deployer register: Annex III classification, accountability, auto-populated fields, exports, and review cadence. Read more →](https://www.norcaster.com/docs/ai-register)[ ### Trust center Hosting, subprocessors, security controls summary, and alignment with Security & Compliance docs. Read more →](https://www.norcaster.com/trust)[ ### Glossary Plain-language definitions for deployments, workflows, MCP, policies, contracts, traces, evals, and audit events. Read more →](https://www.norcaster.com/docs/glossary)[ ### Student privacy Block or flag when student PII patterns are detected. Education and privacy contexts. Read more →](https://www.norcaster.com/docs/student-privacy)[ ### Teams Org → Team → Project → Deployment. Roles: team\_admin, developer, viewer. Read more →](https://www.norcaster.com/docs/teams)[ ### Retrieval integrations Vector backends (pgvector, Pinecone, Weaviate, Qdrant) and semantic search APIs. Read more →](https://www.norcaster.com/docs/retrieval)[ ### Knowledge source configuration Ingestion: upload, S3, web. Chunking, embedding, vector index setup. Read more →](https://www.norcaster.com/docs/knowledge) ## Quick start (API) Deploy with a contract, run inference, and see enforcement at the boundary. ### 1\. Deploy with enforcement Use dashboard onboarding or CLI. Contract enforcement is enabled by default. ### 2\. Run inference Valid requests pass. Invalid requests are blocked at the boundary. ``` curl -X POST https://api.norcaster.com//run \ -H "X-API-Key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"deployment_id": "YOUR_DEPLOYMENT_ID", "input": {"prompt": "Hello, world!"}}' ``` ### 3\. CLI Install, authenticate, deploy, and run. Enforcement applies to every request. ``` pip install norcaster export NORCASTER_API_KEY="" norcaster deploy qx-example norcaster run -i '{"prompt": "Hello!"}' ``` Markdown mirror for editors: `docs/START_HERE.md` in the repo (linked from [/docs/start](https://www.norcaster.com/docs/start) above).