Related Work

How does Tenuo fit into the broader AI agent security landscape?

CaMeL

Paper: Defeating Prompt Injections by Design (Debenedetti et al., 2025)

CaMeL introduces a protective system layer around LLMs that secures agentic systems against prompt injection. Key ideas:

• Capability tokens: Explicit authorization for tool invocations
• Control/data flow separation: Untrusted data cannot impact program flow
• P-LLM / Q-LLM architecture: Privileged planner issues tokens to worker LLMs

Tenuo implements CaMeL’s capability token model:

CaMeL is the architecture. Tenuo is the authorization primitive.

Microsoft FIDES

Paper: Securing AI Agents with Information-Flow Control (Costa et al., 2025)

FIDES uses information-flow control (IFC) to track data provenance through agent execution:

• Taint tracking: Labels data with confidentiality/integrity levels
• Policy enforcement: Prevents unauthorized data flows
• Selective hiding: Primitives for controlling information visibility

Tenuo and FIDES solve different problems:

Tenuo tracks action flow (what operations are authorized).
FIDES tracks data flow (what information goes where).

Complementary Approaches

A complete defense may use both:

┌─────────────────────────────────────────────────────────────────┐
│                        Agent System                              │
│                                                                  │
│   ┌─────────────┐                      ┌─────────────────────┐  │
│   │   FIDES     │                      │      Tenuo          │  │
│   │             │                      │                     │  │
│   │  "Is this   │                      │  "Is this agent     │  │
│   │   data      │  ───────────────────▶│   allowed to call   │  │
│   │   tainted?" │                      │   this tool with    │  │
│   │             │                      │   these args?"      │  │
│   └─────────────┘                      └─────────────────────┘  │
│         │                                       │               │
│         ▼                                       ▼               │
│   Data flow policy                      Action authorization    │
│   (confidentiality)                     (capability tokens)     │
└─────────────────────────────────────────────────────────────────┘

Example combined flow:

1. Agent reads file → FIDES labels data as confidential:internal
2. Agent wants to send email → Tenuo checks warrant allows send_email
3. FIDES checks: can confidential:internal data flow to email recipient?
4. Both must approve for action to proceed

Key Differences

Authority Separation

Paper: Authority Separation in AI Systems (Shamim, 2025)

This paper provides empirical validation of the architectural pattern Tenuo implements. Key findings across 1,000 adversarial test cases:

Core thesis: Prompt injection, hallucination, and repeated failures are manifestations of a single architectural flaw—coupling generation with execution authority. Separating these concerns provides structural guarantees that persist under adversarial conditions.

Tenuo implements this separation: models propose actions, the authorizer enforces constraints.

Prior Art

Tenuo builds on established capability-based authorization patterns:

Why Not Just Use Biscuit?

Biscuit is excellent. Both Tenuo and Biscuit support offline attenuation with similar mechanisms. Tenuo differs in:

1. Threat model — Designed specifically for AI agents processing untrusted input
2. PoP binding — Mandatory proof-of-possession (Biscuit has optional third-party caveats)
3. Constraint types — Purpose-built for tool authorization (Pattern, Range, OneOf)
4. Authorization model — Closed-form constraint predicates vs Datalog policies

If you need general-purpose capability tokens with flexible policy logic, consider Biscuit.
If you need AI agent authorization with prompt injection defense, use Tenuo.

Industry Approaches

These focus on model behavior. Tenuo focuses on authorization infrastructure.

The approaches are complementary: model-level defenses reduce the likelihood of malicious intent; Tenuo limits the blast radius when defenses fail.

Prompt Injection Defenses

Traditional Authorization Mapping

Citation

If you reference Tenuo in academic work:

@software{tenuo2025,
  title = {Tenuo: Capability-Based Authorization for AI Agents},
  year = {2025},
  url = {https://github.com/tenuo-ai/tenuo}
}

See Also

• Concepts — Why Tenuo? Problem/solution overview
• Protocol Specification — How warrants work
• Security — Detailed threat model