tenuo

Cryptographic authorization primitive for AI agents.

Status: v0.2 — Production/Stable. Core semantics are stable. See CHANGELOG.

Overview

Tenuo implements capability tokens (Warrants) for AI agent authorization:

• Offline verification in under 50 μs - no network calls
• Monotonic attenuation - delegated tokens can only shrink in scope
• Proof-of-possession - stolen tokens are useless without the private key
• Constraint types - Exact, Pattern, Range, OneOf, Regex, Wildcard, CEL, UrlPattern, Cidr
• Multi-sig approvals - M-of-N cryptographic approval requirements

Quick Start

use tenuo::{SigningKey, Warrant, Constraint, ConstraintSet, Authorizer};

// Generate keys
let issuer_key = SigningKey::generate();
let holder_key = SigningKey::generate();

// Issue a warrant
let warrant = Warrant::builder()
    .capability("read_file", ConstraintSet::new().insert("path", Constraint::pattern("/data/*")))
    .holder(holder_key.public_key())
    .ttl_secs(300)
    .build(&issuer_key)?;

// Verify and authorize
let authorizer = Authorizer::new(vec![issuer_key.public_key()]);
authorizer.verify_and_authorize(
    &warrant,
    "read_file",
    &[("path", "/data/report.txt")],
    Some(&holder_key.create_pop(&warrant, "read_file", &args)?),
)?;

Rust SDK (sdk feature)

Default-off. Guard enforces; ObservingGuard only assesses and is not a substitute.

use tenuo::{args, Call, RevocationMode, Tenuo};
use std::time::Duration;

let (guard, authority) = Tenuo::local()
    .trusted_root(root)
    .chain(chain)
    .signer(holder_key)
    .revocation(RevocationMode::TtlOnly { max_lifetime: Duration::from_secs(300) })
    .build()?;

let args = args! { "path" => "/data/report.txt" };
let call = Call::borrowed("read_file", &args);
guard.guard(&authority, &call, |_authorized| do_read())?;

An enforcement point uses Tenuo::enforcement() and Guard::guard_received on a ReceivedAuthorization decoded from _meta.tenuo or HTTP headers. The holder path always signs; the received path never does.

Run the MCP hop demo:

cd tenuo-core && cargo run --example sdk_mcp_demo --features sdk,mcp-transport

Features

Use Cases

• Sidecar authorizer - Verify warrants at the edge
• Gateway integration - Envoy/Istio external authorization
• Embedded verification - In-process authorization checks

Documentation

• tenuo.ai - Full documentation
• docs.rs/tenuo - API reference
• GitHub - Source code

License

Apache-2.0. See LICENSE for details.