tenuo 0.3.2

Task-scoped authorization for AI agents: signed warrants that constrain tools and arguments, narrow on delegation, and verify offline. Rust core of Tenuo.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

//! Framework-independent enforcement surface.
//!
//! Default-off (`sdk` feature). Holder-sign and received-verify share one
//! `Authorizer` decision. Transport bindings are extra features.
//!
//! `ObservingGuard` is an assessment window, not enforcement. Receipts, async,
//! and OpenTelemetry are separate default-off features.
//!
//! [`Runtime`] is the primary holder entry: persist identity, apply SRLs,
//! and bind warrants into [`Session`]s. [`Tenuo::local`] is deprecated.

mod approvals;
mod authority;
mod call;
mod clock;
mod decision;
mod delegation;
mod diagnostics;
mod guard;
mod identity;
#[macro_use]
mod macros;
mod observe;
pub mod prelude;
mod runtime;
mod signer;
mod tenuo;

#[cfg(feature = "test-utils")]
pub mod test_utils;

#[cfg(feature = "async")]
mod async_api;
#[cfg(feature = "receipts")]
mod evidence;
#[cfg(feature = "otel")]
mod telemetry;

#[cfg(any(feature = "mcp-transport", feature = "http-transport"))]
pub mod transport;

pub use approvals::{approve_request, ApprovalError, ApprovalProvider, LocalApprovalSigner};
pub use authority::{
    AuthorityError, CapabilityView, OwnedReceivedAuthorization, PresentedAuthority,
    ReceivedAuthorization,
};
pub use call::{ArgumentError, Call, VerifiedProjection};
#[cfg(feature = "test-utils")]
pub use clock::FixedClock;
pub use clock::{Clock, SystemClock};
pub use decision::{
    Decision, DecisionMetadata, Denial, DenialReporting, GuardError, Retryability, SdkDenialKind,
};
pub use delegation::{DelegationError, DelegationProfile};
pub use diagnostics::Diagnostics;
pub use guard::{
    AuthorizationAttempt, AuthorizedCall, Guard, GuardBuildError, GuardBuilder, Guarded,
    RevocationMode,
};
pub use identity::{IdentityError, PersistentIdentity};
pub use observe::{
    ArgumentShape, ArgumentShapePolicy, ObservationRecord, ObservationVerdict, ObserveBuildError,
    ObserveError, Observed, ObservedOutcome, ObservingGuard, ObservingGuardBuilder,
    PresentedRequest, ValueClass,
};
pub use runtime::{Runtime, RuntimeBuilder, RuntimeError, Session, SessionWarrant};
pub use signer::{
    DelegationSigningRequest, HolderSigner, LocalSigner, PopSigningRequest, SignerError,
};
pub use tenuo::{EnforcementBuilder, LocalBuilder, Tenuo, TenuoBuildError};

#[cfg(feature = "async")]
pub use async_api::{
    AsyncHolderSigner, AsyncRevocationProvider, AttemptControl, PresentedAsyncAuthority,
};
#[cfg(feature = "receipts")]
pub use evidence::{
    EvidencePolicy, LocalReceiptSigner, MemoryReceiptSink, ReceiptRef, ReceiptSigner,
    ReceiptSignerError, ReceiptSigningRequest, ReceiptSink, ReceiptSinkError,
};

#[cfg(test)]
mod spec_invariants;