Documentation

Every page here is the same markdown that ships in the repositories, so the docs on this site are the docs you get with the packages. New here? Start with Getting started. Checking a run someone else produced? Start with The auditor's walkthrough.

attenu-guard

• Getting started — Install Attenu Guard, attach it to your framework, and see a denial and a verified log — the library README.
• The auditor's walkthrough — Verify a run you did not produce, with the verifier alone; three sample bundles.
• Integrations — Sixteen frameworks integrated unmodified: hooks, versions, what each framework enforces itself.
• Controls mapping — OWASP ASI03/07/08 and Agent Baseline AUT-03 → mechanism, pinning test, and what is not covered.
• Denial contract — What a denied call returns, and what held for a person means versus denied.
• Red-team report — Attacks tried against the handoff rules, and the checks that still held.
• Standards alignment — What is reused from OAuth/WIMSE, what is new, and how the draft converges.
• Internet-Draft — Verifiable attenuated delegation for AI agent chains — working revision -01; published revision -00 remains on the IETF Datatracker.

Examples

• Example · Google ADK — Peer transfer, contained — what passes when ADK lets a transfer through.
• Example · LangGraph — The subagent middleware, with authority attached.
• Example · OpenAI Agents SDK — One policy, every capability: is_enabled, handoffs and MCP tool_filter driven by one Authority.
• Example · Omnigent — A policy handler with a chain ceiling, per-sub-agent narrowing and an offline-verifiable log.
• Example · Claude Code — Claude Code already narrows its subagents; here is the record that proves it did.
• Example · MCP server — An MCP server that checks the delegation chain before it runs a tool.

attenu-guard

• Sub-agent permissions — Does a sub-agent inherit its parent's permissions? What five frameworks do at a handoff, verified, and how child ⊆ parent is computed and enforced.

Examples

• Example · CrewAI — CrewAI tool permissions and delegation: every coworker's tools checked through CrewAI's global tool hooks; a delegated agent's set is a subset of the delegator's.
• Example · Pydantic AI — Pydantic AI agent delegation with permissions: a capability checks each tool call; GuardedDeps.delegate() narrows the delegated agent.
• Example · AutoGen — AutoGen handoffs with permissions: what a receiving agent may use, checked before the tool runs.
• Example · smolagents — smolagents managed agents with permissions: the managed agent's tools are a subset of the manager's.
• Example · AWS Strands — AWS Strands agents-as-tools, swarm and graph handoffs with permissions, through the public hook API.
• Example · LlamaIndex — LlamaIndex agent workflows with per-agent permissions on tool calls and handoffs.
• Example · Semantic Kernel — Semantic Kernel function invocation filters as the permission check, and the two traps the adapter is built around.
• Example · Agno — Agno teams with permissions: tool hooks on every member, delegation narrowed at the team boundary.
• Example · Haystack — Haystack agent permissions: every Tool.invoke checked; an AgentTool handoff mints a narrower sub-agent.
• Example · CAMEL-AI — CAMEL-AI sub-agent permissions: AgentToolkit and Workforce handoffs narrowed, every tool call checked.
• Example · Microsoft Agent Framework — Microsoft Agent Framework permissions as FunctionMiddleware: as_tool and handoff edges narrowed before the sub-agent starts.
• Example · AG2 — AG2 1.0 permissions through on_tool_execution middleware and a per-tool hook for auto-spawned subtasks.
• Example · A2A — A2A (Agent2Agent) permissions across a hop: the signed delegation chain travels as an A2A extension; the remote agent runs with a subset of the caller's set.
• Example · Langflow — A Langflow custom component that checks every tool invocation and narrows a downstream agent through a flow edge.
• Example · Claude Agent SDK — Claude Agent SDK with permissions, live-verified: a real subagent over-reach denied.

attenu-guard

• TypeScript / Node.js — attenu-guard for TypeScript: the same enforcement and the same bundle format as the Python library, verified by cross-language fixtures; LangGraph.js adapter; npm install attenu-guard.

attenu-derive

• The engine — How Attenu Derive works out each agent's permissions from your app, and what has been measured.
• Threat model — Trust boundaries, attacker model, five invariants with mechanism and test, residual risks.
• Live enforcement — Real applications denied mid-run on two models; permissions narrowing across a real handoff chain.
• Onboarding — Day-0 on an app the engine has never seen, and the measured curation share.
• Operations — Modes, rollback, custody, what leaves your environment.
• What is proven — The evidence pack: every gate, its bound, and what is not met.
• Security review — A structured self-review, single reviewer — stated as such.
• Three frameworks, live — CrewAI, LangGraph and ADK enforced on the same workload, no divergence.