Tenuo

Open-source authorization for AI agents. Task-scoped permissions, delegation that only narrows, an audit trail for every action.
Rust, Python, Typescript

[Tenuo @TenuoAI]

Tenuo is now Open Beta!

Free developer tier, setup in minutes, and a free lab to get you familiar with binding authorization to tasks and how it prepares your agentic workflows for swarms and delegation

Come try us out @ https://t.co/MXq3BxJ0k0

#AISecurity #AIAgents

[Tenuo @TenuoAI]

https://t.co/7QjcgxUk7u

[Tenuo @TenuoAI]

First @DecagonAI launched PACT.

Then @AIatMeta + @SierraPlatform announced PAP with @Genesys , @Shopify , @stripe , @Walmarttech and others.

Both help a business answer: “Did this customer authorize this agent?”

The next question is: “Authorize it to do exactly what?”

If I say “rebook Friday, aisle seat, ask me above $300,” those terms should travel with the agent and be enforceable by the airline.

That’s where we think Tenuo fits.

PACT/PAP get you to the customer’s yes. Tenuo carries what the yes covered.

[Tenuo @TenuoAI]

The prompt injection worked.

The unauthorized action didn’t.

Rajan built an AEO agent with Temporal + Tenuo that can inspect a repo, make changes and open a PR.

In the demo, it takes the bait and tries to read .env.

Tenuo denies the tool calls. The agent carries on with the job.

This is the kind of agent we want to make possible: one you can actually trust to take action.

https://t.co/EWRx7JBCKn

[RajanChavada @RajanChavada]

Building an AEO agent that edits client sites and opens PRs. It reads untrusted pages and holds a GitHub token.

Prompts can't stop injection, so I added @TenuoAI. Every tool call needs a scoped warrant. The model never holds a key.

Try to break it:
https://t.co/LVHfpX9ARo

[Tenuo @TenuoAI]

An AEO agent reads untrusted pages all day and also needs edit access to the site. Thank you Rajan for highlighting your usecase of Tenuo to limit the blast radius of prompt injections and enable a more frictionless, trusted agent experience.

Really liked your approach to assume injection sometimes works, and cap what the agent can do when it does. Scope the authority to one site, the pages or fields the task covers, the operations it needs, and a short expiry. A hijacked agent can then only act inside that envelope.

What does your agent's CMS credential allow today: one page, one site, or everything?

[RajanChavada @RajanChavada]

Building an AEO agent that edits client sites and opens PRs. It reads untrusted pages and holds a GitHub token.

Prompts can't stop injection, so I added @TenuoAI. Every tool call needs a scoped warrant. The model never holds a key.

Try to break it:
https://t.co/LVHfpX9ARo

[Tenuo @TenuoAI]

Full writeup here: https://t.co/RMaxsUcEbp

[Tenuo @TenuoAI]

A recent Delinea survey found 87% said an AI tool or agent reached sensitive data it wasn’t meant to access, despite 99.7% of respondents having an existing security policy.

The interesting part isn’t that companies need more policy. It’s that written policy rarely becomes a hard runtime boundary.

A prompt can tell an agent to only work on customer 4471, but if its service token is widely scoped to every customer, the token determines the actual blast radius.

We dug into where that enforcement gap comes from, why it gets harder with subagents, and what it means to enforce scope before an action runs in our latest blog linked below

For those running agents with real tool access, where does policy become enforcement in your stack today? Have you found instances of your agents reaching into unexpected areas they weren't supposed to?

[RajanChavada @RajanChavada]

Building an AEO agent that edits client sites and opens PRs. It reads untrusted pages and holds a GitHub token.

Prompts can't stop injection, so I added @TenuoAI. Every tool call needs a scoped warrant. The model never holds a key.

Try to break it:
https://t.co/LVHfpX9ARo

[Tenuo @TenuoAI]

Hi Harley 👋
Tenuo warrants are signed to the agent. We solve proof of possession, so a leaked warrant is not a problem. No one else can use it.

Ideally the scope is provided deterministically before task run, but we support human in the loop escapw hatches if the agent requires more scope.

For revocation, we support Signed revocation lists. Revocation of a parent, revokes all child warrants as well.

[Tenuo @TenuoAI]

Hector's full writeup, including his flow diagram and where the gap sits:
https://t.co/aSMq5rLw6h

Part two covers the @guard + mint_sync pattern he used in homelab-mcp.

[Tenuo @TenuoAI]

An engineer gave an AI agent control of his home server cluster, with one safety rule: nothing changes until he says yes.

Then he realized the AI could say yes for him.

Hector M. wrote up how he got there, and it's a mistake worth checking for in any setup with a human approval step. Link in the thread below

It started with the AI being confidently wrong. It told him his GPU had 6,269 MB in use out of 1,515 MB total. It kept trying to restart an app under a name that didn't exist.

If the AI is this sure of itself when it's wrong about numbers, it'll be just as sure when it's wrong about what to restart. And he'd probably approve it, because it would sound right.

So he added Tenuo. Now when he approves an action, the AI gets a signed permission for that one action only: one app, one part of the cluster, good for 60 seconds. Anything outside that gets blocked.

Then, while writing up his setup, he noticed a problem. His "yes" never went straight to the system. It went to the AI, and the AI passed it along.

So the AI could change what he approved before passing it on. Or it could misread the chat, or get tricked by something it read, and claim he said yes when he didn't. The system would treat it as approved either way.

Tenuo did its job. The approval was coming from the wrong place, and he says so himself.

If your AI is the one delivering your approval, it can also fake it.

He's saving the fix for part two and asked readers not to spoil it, but its encouraging to see our solution being used in all sorts of different use cases and workflows.

[Tenuo @TenuoAI]

As Hermes takes the fight to enterprise, we are working on a plugin to enable enterprise users to have fine grained authorization for their agents, so that they can reduce blast radius and make agentic actions deterministic (even through delegation) to cut downside risk of shent misbehaviour

[Tenuo @TenuoAI]

We think that there is a better method than OAuth to achieve fine-grained, delegation proof authorization that reduces user friction and increases trust.

OAuth scopes record what a customer approved, but they don't limit how far an agent can go inside that approval, such as the refund amount or which order it applies to. Credentials that can only get narrower as work is handed along, and that any party can verify without calling back to the issuer, would tie a personal agent's authority to the one task the customer approved.

The value of personal agents is reducing friction. Without fine grained authorization, you require users to constantly approve any action, leading to decision fatigue and transferring user burden from a shopping experience designed to maximize dopamine to verification and review of specifics out of fear your agent might have messed something. We take the guesswork out so that there are less friction points, less attention needed, and more volume transacted.

We have an open standard that enables fine grained authorization, tied to the specific task. Each time an agent wants to take action, its evaluated against its permission slip (rather than one time verification like in OAuth), and this check is extended to any sub agents it delegates to, effectively creating a pair of handcuffs that limit agentic actions to only a set of permissible ones (e.g. purchase this coffee, max spend limit, only deliver to this address, expires in 10 mins)

[Tenuo @TenuoAI]

Hi Gram, curious on how the team is evaluating granularity of scopes with OAuth.

Since scopes are an id plus a description, an approved refunds:issue covers any amount. Per-scope argument limits, like an amount cap, account would close it. We developed something that allows for the authorization to be more granular and applied at the task-level versus just using the identify. Let us know how we can collaborate

[Tenuo @TenuoAI]

@SierraPlatform @Meta @Genesys @instinct @RocketOTD @Shopify @stripe @Walmart The draft, for anyone working on agent delegation over OAuth. It's an individual draft and a work in progress, and feedback is welcome:
https://t.co/KPwJraI1Qx

[Tenuo @TenuoAI]

with OAuth, read vs write is a wide grant for an agent.
Write access that can process a return can usually also change the refund method or the shipping address. Since the session carries across the site, the APIs and the company's agent, that grant goes with it to every channel.

Finer-grained permissions are scoped as future work. A few things we'd push for in the spec:
1. Grants scoped to the task: which actions, which argument limits, and an expiry tied to the job
2. Authority that can only narrow when the personal agent hands work to a sub-agent, or the company agent passes it to a back-office one
3. A signed record of each action that the business can verify and the customer can review

We've been working on this as an OAuth extension (individual IETF draft, profiles RFC 9396). Would like to join the design workshops

[Tenuo @TenuoAI]

Our full technical write-up about our Openshell integration can be found here: https://t.co/3SzH8GVolr

Excited to help enable enterprises and devs control agentic actions!

[Tenuo @TenuoAI]

Tenuo has been accepted in the @nvidia Inception program, and our first release since joining is an integration with NVIDIA OpenShell.

OpenShell controls what an agent's sandbox can reach. Tenuo controls what each task can do there.

e.g. An on-call agent can read staging logs for tonight's ticket but gets refused on production logs, and must wait for human approval before restarting anything to prevent accidental production changes.

No fork and no changes to your agent code. The demo takes five minutes, no API key needed. Try it and tell us what breaks.

The Openshell writeup below

[Tenuo @TenuoAI]

My dream: approve a scoped task once ("open PRs in this repo, never push to main, 4 hours") and have every specialist dot inherit that scope or narrower. With that, I'd give a dot write access to my repos tomorrow.

My nightmare: A dot asked to investigate a failing deploy hands off to a specialist with deploy access, every check passes, and prod gets rolled back. Nothing records that the task was only an investigation.

Is task-scoped authority on the radar for teams of dots?

[Tenuo @TenuoAI]

@cloudsa Hello 👋 we’ve written about this in depth here: https://t.co/zKchZUJbqn

TL;DR - we need an open standard to do task based authz. That’s what Tenuo is building.

[Tenuo @TenuoAI]

@cloudsa We believe that least privilege for agents is with task-scoped authorization. We make a case for it here using Salesbleed as an example: https://t.co/mxMwicUz7a