Global or scoped freeze
Freeze all autonomous spend, or freeze by lane, agent or counterparty when the incident is local rather than systemic.
NORNR
Emergency controls should be as first-class as policy and proof.
NORNR / Emergency controls
Core moatWhen the lane goes wrong, the emergency model should already exist.
Emergency controls are not a last-minute admin feature. They are a first-class part of category ownership: freeze, revoke, step up review and snapshot the trail before the problem spreads.
Control model
These controls should exist before the first autonomous lane widens.
That is what makes NORNR feel safer than rails, wallets or raw tool wrappers.
Revoke mandate without moving assets
Pull authority back from the lane while leaving the rest of the system intact and attributable.
Review-only or step-up review mode
Keep the lane alive but require human review above a tighter threshold while the incident posture is active.
Emergency export snapshot
Emit one finance and risk-safe artifact showing what was pending, what was blocked and what already settled when the control changed.
Recovery posture
Move from freeze to review-only, then from review-only back to normal automation with a recorded reason and timeline.
Trust becomes operational, not rhetorical
The moat is not only that NORNR decides. It is that NORNR also gives teams a credible brake when the right answer is to stop.