Tenuo

First @DecagonAI launched PACT. Then @AIatMeta + @SierraPlatform announced PAP with @Genesys , @Shopify , @stripe , @Walmarttech and others. Both help a business answer: “Did this customer authorize this agent?” The next question is: “Authorize it to do exactly what?” If I say “rebook Friday, aisle seat, ask me above $300,” those terms should travel with the agent and be enforceable by the airline. That’s where we think Tenuo fits. PACT/PAP get you to the customer’s yes. Tenuo carries what the yes covered.

A recent Delinea survey found 87% said an AI tool or agent reached sensitive data it wasn’t meant to access, despite 99.7% of respondents having an existing security policy. The interesting part isn’t that companies need more policy. It’s that written policy rarely becomes a hard runtime boundary. A prompt can tell an agent to only work on customer 4471, but if its service token is widely scoped to every customer, the token determines the actual blast radius. We dug into where that enforcement gap comes from, why it gets harder with subagents, and what it means to enforce scope before an action runs in our latest blog linked below For those running agents with real tool access, where does policy become enforcement in your stack today? Have you found instances of your agents reaching into unexpected areas they weren't supposed to?

An engineer gave an AI agent control of his home server cluster, with one safety rule: nothing changes until he says yes. Then he realized the AI could say yes for him. Hector M. wrote up how he got there, and it's a mistake worth checking for in any setup with a human approval step. Link in the thread below It started with the AI being confidently wrong. It told him his GPU had 6,269 MB in use out of 1,515 MB total. It kept trying to restart an app under a name that didn't exist. If the AI is this sure of itself when it's wrong about numbers, it'll be just as sure when it's wrong about what to restart. And he'd probably approve it, because it would sound right. So he added Tenuo. Now when he approves an action, the AI gets a signed permission for that one action only: one app, one part of the cluster, good for 60 seconds. Anything outside that gets blocked. Then, while writing up his setup, he noticed a problem. His "yes" never went straight to the system. It went to the AI, and the AI passed it along. So the AI could change what he approved before passing it on. Or it could misread the chat, or get tricked by something it read, and claim he said yes when he didn't. The system would treat it as approved either way. Tenuo did its job. The approval was coming from the wrong place, and he says so himself. If your AI is the one delivering your approval, it can also fake it. He's saving the fix for part two and asked readers not to spoil it, but its encouraging to see our solution being used in all sorts of different use cases and workflows.

Tenuo has been accepted in the @nvidia Inception program, and our first release since joining is an integration with NVIDIA OpenShell. OpenShell controls what an agent's sandbox can reach. Tenuo controls what each task can do there. e.g. An on-call agent can read staging logs for tonight's ticket but gets refused on production logs, and must wait for human approval before restarting anything to prevent accidental production changes. No fork and no changes to your agent code. The demo takes five minutes, no API key needed. Try it and tell us what breaks. The Openshell writeup below

SalesBleed leaked Salesforce Agentforce CRM data without a single permission check failing. A hidden malicious instruction submitted via the "contact sales" form planted the trigger. Whenever a rep asked about their own leads, it would set off the trigger and because the agent could query the whole Accounts table, the attacker was able to successfully exfiltrate account data. Our new post shows how to close that gap with task-scoped authority. With Tenuo, every tool call carries a short-lived signed warrant scoped to the current task. When one agent hands work to another, the warrant can only get narrower, and each hop is signed so you can verify who delegated what. In our replay of the attack: - The warrant covers one Lead record for 60 seconds - The agent still reads the poisoned lead - The injected Accounts query is denied at the tool boundary - The denial is recorded as a signed receipt The attack itself, per @zenitysec_labs an attacker plants instructions in a "contact sales" form, a rep later asks Agentforce to check new leads, and the agent pushes company names and deal sizes out through an image URL's DNS lookup. Salesforce has patched those bugs, but the broad-role design behind them shows up in a lot of agent deployments. The post includes a runnable Python example. It's open source and works with MCP, LangChain, CrewAI and more. One caveat. This is not prompt injection prevention, rather Tenuo stops the agent at the point of tool call before any harmful actions can be executed (i.e. we don't claim to improve the thinking of the model, more so putting on handcuffs to prevent malicious action regardless of the model's thought process). If your agent was asked to look at one record today, how many could it have read?

A meaningful milestone for Tenuo and AAT - NIST’s summary of public comments on Agentic AI Identity & Authorization cites our AAT Internet-Draft among emerging approaches to scoped delegation and authorization chaining. The idea is becoming clear across the ecosystem: Authority should travel with the task, narrow at each hop, and never widen

Super encouraging to see our current engagement metrics (now open beta!) - 47k clones - 2.9k pypi installs in the past quarter - 100 github stars & 18 contributors including folks from big tech Authorization in the age of delegation. Come check us out! Thread w/ details below🧵

@temporalio Temporal Nexus lets you call across namespace boundaries as typed, durable workflow calls. No bespoke API, no retry logic to maintain. Netflix, Duolingo and Miro use it for exactly this.If you are running agents across teams, it is the right substrate.