Crate tenuo 

Tenuo Core

Task-scoped authorization for AI agents: the Rust core of Tenuo.

A warrant is a signed grant of which tools an agent may call, with which argument constraints, and for how long. Warrants are holder-bound, can only narrow when delegated, verify offline where the action runs, and produce signed receipts.

Unlike traditional IAM systems that answer “Who are you?”, Tenuo answers “Who delegated this authority, what task context does it carry, and is this action within the delegated bounds?”

Key Concepts

• Warrant: A transferable token of authority containing tool name, constraints, TTL, and signature
• Attenuation: Capabilities can only shrink when delegated, never expand
• Constraints: Restrictions on argument values (Pattern, Exact, OneOf, Range, CEL)

Example

use std::collections::HashMap;
use std::time::Duration;
use tenuo::{
    Authorizer, Constraint, ConstraintSet, ConstraintValue, Pattern, SigningKey, Warrant,
};

let issuer_key = SigningKey::generate();
let holder_key = SigningKey::generate();

let mut constraints = ConstraintSet::new();
constraints.insert(
    "path",
    Constraint::Pattern(Pattern::new("/data/*").expect("pattern")),
);
let warrant = Warrant::builder()
    .capability("read_file", constraints)
    .holder(holder_key.public_key())
    .ttl(Duration::from_secs(300))
    .build(&issuer_key)
    .expect("mint");

let mut authorizer = Authorizer::new();
authorizer.add_trusted_root(issuer_key.public_key());
let mut args = HashMap::new();
args.insert(
    "path".into(),
    ConstraintValue::String("/data/report.txt".into()),
);
let pop = warrant
    .sign(&holder_key, "read_file", &args)
    .expect("pop");
authorizer
    .authorize_one(&warrant, "read_file", &args, Some(&pop), &[])
    .expect("authorize");

With the sdk feature, Runtime is the holder entry:

use std::collections::HashMap;
use std::time::Duration;
use tenuo::sdk::prelude::*;
use tenuo::{ConstraintSet, Warrant};

let issuer = SigningKey::generate();
let holder = SigningKey::generate();
let warrant = Warrant::builder()
    .capability("read", ConstraintSet::new())
    .holder(holder.public_key())
    .ttl(Duration::from_secs(300))
    .build(&issuer)
    .expect("mint");
let runtime = Runtime::builder()
    .holder(holder)
    .trusted_root(issuer.public_key())
    .ttl_fallback(Duration::from_secs(600))
    .build()
    .expect("runtime");
let session = runtime.session_from_warrant(warrant).expect("session");
let args = HashMap::new();
assert!(session
    .diagnostics()
    .why_denied(&Call::borrowed("write", &args))
    .is_some());

Re-exports

pub use strict_json::parse_json_strict;

pub use strict_json::StrictJsonError;

pub use extraction::CompiledExtractionRule;

pub use extraction::CompiledExtractionRules;

pub use extraction::CompiledPath;

pub use extraction::ExtractionRule;

pub use extraction::ExtractionSource;

pub use extraction::RequestContext;

pub use gateway_config::CompiledGatewayConfig;

pub use gateway_config::CompiledRoute;

pub use gateway_config::GatewayConfig;

pub use gateway_config::GatewaySettings;

pub use gateway_config::MethodMask;

pub use gateway_config::RouteConfig;

pub use gateway_config::RouteMatch;

pub use gateway_config::ToolConfig;

pub use mcp::CompiledMcpConfig;

pub use mcp::CompiledTool;

pub use mcp::McpConfig;

pub use mcp::McpSettings;

pub use constraints::All;

pub use constraints::Any;

pub use constraints::AnyOf;

pub use constraints::CelConstraint;

pub use constraints::Cidr;

pub use constraints::Constraint;

pub use constraints::ConstraintDiagnostics;

pub use constraints::ConstraintSet;

pub use constraints::ConstraintValue;

pub use constraints::ConstraintViolation;

pub use constraints::ConstraintViolationKind;

pub use constraints::Contains;

pub use constraints::Exact;

pub use constraints::Not;

pub use constraints::NotOneOf;

pub use constraints::OneOf;

pub use constraints::Pattern;

pub use constraints::Range;

pub use constraints::RegexConstraint;

pub use constraints::Subpath;

pub use constraints::Subset;

pub use constraints::UrlPattern;

pub use constraints::Wildcard;

pub use constraints::MAX_CONSTRAINT_DEPTH;

pub use crypto::PublicKey;

pub use crypto::Signature;

pub use crypto::SigningKey;

pub use error::Error;

pub use error::ErrorCode;

pub use error::Result;

pub use planes::DataPlane;Deprecated

pub use planes::Authorizer;

pub use planes::AuthorizerBuilder;

pub use planes::ChainStep;

pub use planes::ChainVerificationResult;

pub use planes::ControlPlane;

pub use planes::VerifiedApproval;

pub use planes::DEFAULT_CLOCK_TOLERANCE_SECS;

pub use receipt::canonical_policy_bytes;

pub use receipt::policy_commitment_digest;

pub use receipt::srl_commitment_digest;

pub use receipt::trusted_roots_digest;

pub use receipt::Receipt;

pub use receipt::ReceiptPayload;

pub use revocation::RevocationRequest;

pub use revocation::SignedRevocationList;

pub use revocation::SrlBuilder;

pub use revocation::MAX_REVOCATION_REQUEST_AGE_SECS;

pub use revocation_manager::RevocationManager;

pub use revocation_tracker::FileFloorStore;

pub use revocation_tracker::InMemoryFloorStore;

pub use revocation_tracker::RevocationError;

pub use revocation_tracker::RevocationFloorStore;

pub use revocation_tracker::RevocationTracker;

pub use revocation_tracker::RevocationUpdate;

pub use sdk::transport::TransportError;http-transport or mcp-transport

pub use sdk::FixedClock;test-utils

pub use sdk::ApprovalError;sdk

pub use sdk::ApprovalProvider;sdk

pub use sdk::ArgumentShape;sdk

pub use sdk::ArgumentShapePolicy;sdk

pub use sdk::AuthorizationAttempt;sdk

pub use sdk::AuthorizedCall;sdk

pub use sdk::Call;sdk

pub use sdk::Clock;sdk

pub use sdk::Decision;sdk

pub use sdk::DecisionMetadata;sdk

pub use sdk::DelegationError;sdk

pub use sdk::DelegationProfile;sdk

pub use sdk::Denial;sdk

pub use sdk::DenialReporting;sdk

pub use sdk::Diagnostics;sdk

pub use sdk::Guard;sdk

pub use sdk::GuardBuildError;sdk

pub use sdk::GuardError;sdk

pub use sdk::HolderSigner;sdk

pub use sdk::IdentityError;sdk

pub use sdk::LocalApprovalSigner;sdk

pub use sdk::LocalSigner;sdk

pub use sdk::ObservationRecord;sdk

pub use sdk::ObservationVerdict;sdk

pub use sdk::ObserveBuildError;sdk

pub use sdk::ObserveError;sdk

pub use sdk::Observed;sdk

pub use sdk::ObservedOutcome;sdk

pub use sdk::ObservingGuard;sdk

pub use sdk::ObservingGuardBuilder;sdk

pub use sdk::OwnedReceivedAuthorization;sdk

pub use sdk::PersistentIdentity;sdk

pub use sdk::PresentedAuthority;sdk

pub use sdk::PresentedRequest;sdk

pub use sdk::ReceivedAuthorization;sdk

pub use sdk::Retryability;sdk

pub use sdk::RevocationMode;sdk

pub use sdk::Runtime;sdk

pub use sdk::RuntimeError;sdk

pub use sdk::SdkDenialKind;sdk

pub use sdk::Session;sdk

pub use sdk::SessionWarrant;sdk

pub use sdk::SystemClock;sdk

pub use sdk::Tenuo;sdk

pub use sdk::TenuoBuildError;sdk

pub use sdk::ValueClass;sdk

pub use sdk::VerifiedProjection;sdk

pub use sdk::AsyncHolderSigner;async

pub use sdk::AsyncRevocationProvider;async

pub use sdk::AttemptControl;async

pub use sdk::PresentedAsyncAuthority;async

pub use sdk::EvidencePolicy;receipts

pub use sdk::LocalReceiptSigner;receipts

pub use sdk::MemoryReceiptSink;receipts

pub use sdk::ReceiptRef;receipts

pub use sdk::ReceiptSigner;receipts

pub use sdk::ReceiptSignerError;receipts

pub use sdk::ReceiptSigningRequest;receipts

pub use sdk::ReceiptSink;receipts

pub use sdk::ReceiptSinkError;receipts

pub use verification::RevocationSnapshot;

pub use verification::RevocationState;

pub use verification::VerificationContext;

pub use verification::VerificationInstant;

pub use warrant::Clearance;

pub use warrant::OwnedAttenuationBuilder;

pub use warrant::OwnedIssuanceBuilder;

pub use warrant::PreparedDelegation;

pub use warrant::Warrant;

pub use warrant::WarrantBuilder;

pub use warrant::WarrantId;

pub use warrant::WarrantType;

pub use warrant::POP_MAX_WINDOWS;

pub use warrant::POP_TIMESTAMP_WINDOW_SECS;

pub use warrant::WARRANT_ID_PREFIX;

pub use wire::MAX_WARRANT_SIZE;

pub use approval_gate::approval_requirement;

pub use approval_gate::encode_approval_gate_map;

pub use approval_gate::evaluate_approval_gates;

pub use approval_gate::inspect_approval_gate;

pub use approval_gate::merge_approval_gate_maps;

pub use approval_gate::normalize_approval_gate_message;

pub use approval_gate::parse_approval_gate_map;

pub use approval_gate::propagate_approval_gates;

pub use approval_gate::resolve_approval_required_message;

pub use approval_gate::ApprovalGateError;

pub use approval_gate::ApprovalGateInspection;

pub use approval_gate::ApprovalGateKind;

pub use approval_gate::ApprovalGateMap;

pub use approval_gate::ApprovalRequirement;

pub use approval_gate::ArgApprovalGate;

pub use approval_gate::ToolApprovalGate;

pub use approval_gate::APPROVAL_GATE_MESSAGE_MAX_CHARS;

pub use approval::ApprovalRequest;

pub use approval_gate::APPROVAL_GATE_EXTENSION_KEY;

pub use diff::ChangeType;

pub use diff::ClearanceDiff;

pub use diff::ConstraintDiff;

pub use diff::DelegationDiff;

pub use diff::DelegationReceipt;

pub use diff::DepthDiff;

pub use diff::ToolsDiff;

pub use diff::TtlDiff;

pub use domain::WARRANT_CONTEXT as SIGNATURE_CONTEXT;

Modules

approval

Approval types for human-in-the-loop and multi-sig workflows.

approval_gate

Approval gate types for conditional approval requirements.

audit

Audit Logging infrastructure.

cel

CEL (Common Expression Language) evaluation for Tenuo constraints.

connect_token

Connect token support for streamlined onboarding.

constraints

Constraint types for Tenuo warrants.

crypto

Cryptographic primitives for Tenuo.

diff

Delegation diff computation for audit and preview.

domain

Domain separation constants for cryptographic signatures.

error

Error types for Tenuo.

extraction

Constraint Extraction System

gateway_config

Gateway Configuration Parser

heartbeatserver

Heartbeat module for control plane integration.

mcp

MCP (Model Context Protocol) Integration Helpers

meta_envelope

One encoding of _meta.tenuo.

payload

planes

Control Plane and Data Plane separation.

pythonpython

Python bindings for Tenuo via PyO3.

python_control_planepython-server

receipt

Authorization receipts (v1).

revocation

Revocation System

revocation_manager

Revocation Manager

revocation_tracker

Enforcement-point revocation tracker: verify, freshness, and persistent floor.

sdksdk

Framework-independent enforcement surface.

shell_words

POSIX shell tokenization for crate::constraints::Shlex.

strict_json

JSON text parsing that rejects a repeated key.

verification

Explicit verification time and revocation state for one authorization decision.

warrant

Warrant type - the core primitive of Tenuo.

wire

Wire format for Tenuo warrants.

Macros

argssdk

Build an owned argument map. Infallible for Into<ConstraintValue> values.

constraintssdk

Build a ConstraintSet for one capability.

Constants

DEFAULT_WARRANT_TTL_SECS

Default TTL when not specified (5 minutes).

IDENTITY_BINDING_EXTENSION_KEY

MAX_DELEGATION_DEPTH

Maximum delegation depth to prevent unbounded chains (protocol-level hard cap).

MAX_WARRANT_TTL_SECS

Protocol-level maximum TTL (90 days).

WIRE_VERSION

Current wire format version