Most companies have an AI policy. Very few can enforce it.

Tenuo is open-source authorization for AI agents. You give your agent a signed permission slip for the task in front of it, which we call a warrant, saying what it may touch and for how long. Tenuo checks every tool call against that warrant before it runs, and if the agent hands part of the job to another agent, the warrant can only get narrower on the way. The quickstart gets you running in about five minutes.

Last week Delinea published a survey of about 4,500 people at companies with 500 or more employees, and one number stood out: 87% of the IT and security leaders said an AI tool or agent had reached sensitive data it wasn’t meant to in the past year.

These companies aren’t short on rules. Almost all of them (99.7%) have a formal policy on what AI can access. The hard part is enforcing it. Only about half check access against that policy in real time, and fewer than one in five caught their most recent out-of-scope access while it was happening.

Delinea’s CEO, Art Gilliland, put it well: “Written policy is only as good as your ability to enforce it at the moment an AI agent acts.” We agree, and that is what the rest of this post is about.

Policies were written for people

Think about how a data policy works on your own team. People read it, sign it and mostly stick to it, even when their logins open far more than the day’s work needs: a support rep’s account might reach thousands of customers when today’s queue needs three. That’s been fine, because people are accountable: go browsing records you shouldn’t, and you can lose your job over it.

An agent doesn’t carry any of that. As Mike Albrecht of CrossCountry Consulting told Channel Insider, “An AI agent decides what actions it’s going to take at runtime.” Give it the same job tomorrow and it might take a different path to get there.

So when you tell an agent “only look at this customer’s records”, you’re making a request to a model. The model can misread it, or get talked out of it by text hidden in an email or web page it was asked to read, and meanwhile its credentials still open everything. When the prompt and the credentials disagree, the credentials win.

Agents hold the whole key ring

We’ve written before about the valet key, the spare that starts your car but won’t open the trunk or the glovebox. You’d want an agent’s access sized the same way, to the job in front of it.

Most agents get the whole key ring instead.

Say your bank’s fraud team uses an agent to investigate alerts. To be useful, it runs under a service account that can read every customer’s records and every transaction, and that account stays valid for months, long after any one case is closed. A token like that can do a lot of damage fast, as PocketOS found out in April. A coding agent in their staging environment hit a credential mismatch and decided to fix it on its own. It found a Railway API token in an unrelated file, one created for managing custom domains but allowed to do anything, and used it to delete a volume. That volume held the production database, and the backups lived on it too. The whole thing took nine seconds.

The part that bothers us most is the agent’s rules. They said “NEVER run destructive/irreversible git commands” unless asked, and the deletion went through Railway’s API, which that rule didn’t cover. Someone wrote a rule for the mistake they expected, and the agent made a different one. There was no attacker here, just a valid token with nothing in it saying where to stop.

Comparison showing how traditional standing keys grant broad, persistent access across all systems versus Tenuo’s task-based warrants that enforce minimal, time-bound authorization.

A permission slip for each case, checked on every call

With Tenuo, the fraud agent never gets the key ring. When an alert lands, it gets a warrant, a permission slip for that one case, which spells out:

• which actions the agent may take
• which records it may touch
• limits on amounts, dates or destinations
• which agent is allowed to hold it
• when it expires

For case #4471, that means reading this customer’s records and transactions for the next four hours. Closing the case isn’t on the warrant, and neither is moving money. So if a memo line on one of those transactions says “wire $40,000 to this account”, the agent can try, but the call fails, because nobody ever gave it that authority.

The check sits in front of the bank’s systems and runs before every call. It needs no network call and takes under 50 microseconds, a small fraction of one network round trip, so you aren’t trading speed for safety. Calls that fit the warrant go through, and anything else is stopped before it touches the data.

Workflow showing how Tenuo verifies a signed warrant before an agent action runs, allowing valid requests and blocking unauthorized actions with a signed receipt log.

Handoffs can only narrow

Agents rarely work alone anymore. Case #4471 might have a lead agent that passes the transaction analysis to a helper. With existing authorization models, that helper usually runs with the same credentials as whoever called it, so a compromised helper can reach everything the lead agent could.

Tenuo warrants can only shrink when they’re handed on. The case warrant covers records and transactions for four hours. The lead agent works from a narrower one, transactions only, for two hours, and its helper gets just the last 30 days of transactions for one hour. Nobody down the line can add anything back or stretch the clock. Because every handoff is signed, you can trace the helper’s call step by step back to the warrant issued for the case.

Diagram illustrating how Tenuo progressively restricts authority at each delegation step, ensuring helper agents only receive narrow, time-bound permissions derived from the lead task.

To see this against a real prompt injection, try the Delegation Lab, a free 90-minute lab. We have six agents book a trip, one of them follows an injected instruction, and you tighten what each one may do until the rogue agent gets nowhere.

Evidence that lets you say yes

Now picture an auditor asking why an AI touched a customer’s record. Most teams stitch the answer together from logs in several systems, and Delinea’s numbers show how that goes: only 36% of IT leaders could always trace sensitive AI access back to the person who authorized it, and 55% take a full day or longer to catch an out-of-scope action.

Tenuo can write a signed receipt for every decision it enforces: which agent asked, which warrant it used, the handoffs behind that warrant, and whether the call went through. Because it’s signed, you can check it later without taking the log store’s word for it.

Writing the scope down is also what gets agents approved. 76% of the employees Delinea surveyed said they’d bypassed an AI approval process at some point, and Delinea points to deadlines moving faster than governance. Security holds back when it can’t predict what an agent will do, and a warrant spells it out before the agent starts. You can still keep a person in the loop for the big steps: put case closure behind an approval, and the agent can propose closing #4471, but nothing closes until an analyst signs off.

We should be clear about the limits. A warrant bounds what an agent may do, but it can’t fix the agent’s judgment. If it reads exactly the right records and draws the wrong conclusion, it’s still inside its warrant. It also doesn’t replace your identity and access controls, which still decide who the agent is and whether it gets in. What it adds is a hard limit on how far a mistake, or a manipulated agent, can reach.

Tenuo is open source under Apache 2.0. We’ve written the model up as an IETF Internet-Draft and NIST’s National Cybersecurity Center of Excellence cites it in its summary of comments on agent identity and authorization.

The quickstart takes about five minutes, and if your team is part of that 87%, we’d like to talk.