From Tenuo
Engineering Blog
Articles, tutorials, guides and research on AI agent security and task-scoped authorization, from protocol design through SDKs and integrations to production patterns.
Tenuo in the wild
All external writing and mentions →Detailed case studies from engineers at Dropbox and Google, plus an AAT citation from NIST NCCoE.
Case study
Wiring capability warrants into autonomous agents
Brooks McMillin, Staff Engineer at Dropbox
Warrant gating for MCP tool calls across 16 agents on Kubernetes, delegation at depth 2 and 3, and a live prompt injection the warrant catches.
Read the case study →Case study
Giving an AI agent the keys to my homelab
Hector Hernandez Morales, Cloud Engineer at Google
An agent with write access to a Kubernetes cluster. Each approved call gets a 60-second warrant for one function, one deployment and one namespace. Anything else fails closed.
Read the post →Mention
NIST NCCoE summary of comments on agentic AI identity
NIST National Cybersecurity Center of Excellence
Lists attenuated-token proposals, citing the AAT Internet-Draft, among the efforts moving agents toward explicit, scoped delegation instead of inherited user entitlements.
Read the summary →
We attacked OWASP FinBot with Promptfoo. Tenuo blocked every successful exploit.
We red-teamed OWASP FinBot's AI agents with Promptfoo, with Tenuo on and off. As shipped, 50 attacks got through. With Tenuo, none did.
Read research →
Personal agents that both sides can trust
Personal agents now sign in via PACT and PAP. Task-scoped warrants add the customer's own terms, checked at the API, with receipts both sides can verify.
Read article →
Most companies have an AI policy. Very few can enforce it.
87% of IT leaders say an AI agent reached data it shouldn't have. Why written AI policy breaks down at runtime, and how per-task warrants enforce it.
Read article →
Let Authority Follow the Work: Tenuo for NVIDIA OpenShell
How NVIDIA OpenShell and Tenuo combine secure execution with task-scoped authority that can move across tools, sandboxes, and agent handoffs.
Read article →Give your agent a valet key
SalesBleed leaked Agentforce CRM data without breaking an authorization check. Why AI agents need task-scoped authority, with a runnable Tenuo example.
Read article →Jev in practice: typed decisions, scoped authority
How Jev's typed probabilistic decisions, LangGraph workflows, and Tenuo task-scoped warrants combine in a dependency upgrade agent.
Read case study →Per-request authorization for Temporal Nexus
Nexus allowlists decide whether a namespace may reach an endpoint. They cannot evaluate the request. Here is how task-scoped warrants close that gap without changing service contracts.
Read article →Task-scoped authorization for durable AI workflows
How Tenuo and Temporal combine durable execution with task-scoped cryptographic authorization.
Read article →Tenuo against the OWASP Top 10 for Agentic Applications
How Tenuo maps to the OWASP Top 10 for Agentic Applications with enforcement-focused coverage across ASI01-ASI10.
Read guide →Tenuo and the EU AI Act
How Tenuo's execution-time authorization controls map to key EU AI Act obligations for high-risk AI systems.
Read guide →Your AI agent is authorized to do everything wrong
Why identity-based authorization fails when agents act autonomously, and what warrant-based authorization looks like.
Read article →Authorization for Agentic Systems
Why identity and role-based access control leave an authorization gap for autonomous agents, and how task-scoped warrants close it across delegation chains.
Read research →Nothing matches yet.