# Attenu

> Attenu is an open-source Python library that enforces per-agent permissions on every tool call and sub-agent handoff — a sub-agent never holds more than its parent — and writes a hash-chained audit log you verify offline, across 17 agent frameworks.
> attenu-guard is the enforcement library; attenu-derive computes the permission set each agent task needs from the app itself.
> Every /docs/<slug>/ page is also served as markdown at /docs/<slug>.md. Updated 2026-08-31.

Install: `pip install attenu-guard` · `pip install attenu-derive` · verify a bundle: `pipx run attenu-guard verify bundle.json`
Repos: https://github.com/attenu-io/attenu-guard · https://github.com/attenu-io/attenu-derive · Licence: Apache-2.0


## attenu-guard

- [Getting started](https://attenu.io/docs/getting-started/): Install Attenu Guard, attach it to your framework, and see a denial and a verified log — the library README.
- [The auditor's walkthrough](https://attenu.io/docs/verify/): Verify a run you did not produce, with the verifier alone; three sample bundles.
- [Integrations](https://attenu.io/docs/integrations/): Sixteen frameworks integrated unmodified: hooks, versions, what each framework enforces itself.
- [Controls mapping](https://attenu.io/docs/controls-mapping/): OWASP ASI03/07/08 and Agent Baseline AUT-03 → mechanism, pinning test, and what is not covered.
- [Denial contract](https://attenu.io/docs/denial-contract/): What a denied call returns, and what *held for a person* means versus *denied*.
- [Red-team report](https://attenu.io/docs/red-team/): Attacks tried against the handoff rules, and the checks that still held.
- [Standards alignment](https://attenu.io/docs/standards/): What is reused from OAuth/WIMSE, what is new, and how the draft converges.
- [Internet-Draft](https://attenu.io/docs/internet-draft/): Verifiable attenuated delegation for AI agent chains — working revision -01; published revision -00 remains on the IETF Datatracker.

## Examples

- [Example · Google ADK](https://attenu.io/docs/example-google-adk/): Peer transfer, contained — what passes when ADK lets a transfer through.
- [Example · LangGraph](https://attenu.io/docs/example-langgraph/): The subagent middleware, with authority attached.
- [Example · OpenAI Agents SDK](https://attenu.io/docs/example-openai-agents/): One policy, every capability: is_enabled, handoffs and MCP tool_filter driven by one Authority.
- [Example · Omnigent](https://attenu.io/docs/example-omnigent/): A policy handler with a chain ceiling, per-sub-agent narrowing and an offline-verifiable log.
- [Example · Claude Code](https://attenu.io/docs/example-claude-code/): Claude Code already narrows its subagents; here is the record that proves it did.
- [Example · MCP server](https://attenu.io/docs/example-mcp/): An MCP server that checks the delegation chain before it runs a tool.

## attenu-guard

- [Sub-agent permissions](https://attenu.io/docs/sub-agent-permissions/): Does a sub-agent inherit its parent's permissions? What five frameworks do at a handoff, verified, and how child ⊆ parent is computed and enforced.

## Examples

- [Example · CrewAI](https://attenu.io/docs/example-crewai/): CrewAI tool permissions and delegation: every coworker's tools checked through CrewAI's global tool hooks; a delegated agent's set is a subset of the delegator's.
- [Example · Pydantic AI](https://attenu.io/docs/example-pydantic-ai/): Pydantic AI agent delegation with permissions: a capability checks each tool call; GuardedDeps.delegate() narrows the delegated agent.
- [Example · AutoGen](https://attenu.io/docs/example-autogen/): AutoGen handoffs with permissions: what a receiving agent may use, checked before the tool runs.
- [Example · smolagents](https://attenu.io/docs/example-smolagents/): smolagents managed agents with permissions: the managed agent's tools are a subset of the manager's.
- [Example · AWS Strands](https://attenu.io/docs/example-strands/): AWS Strands agents-as-tools, swarm and graph handoffs with permissions, through the public hook API.
- [Example · LlamaIndex](https://attenu.io/docs/example-llama-index/): LlamaIndex agent workflows with per-agent permissions on tool calls and handoffs.
- [Example · Semantic Kernel](https://attenu.io/docs/example-semantic-kernel/): Semantic Kernel function invocation filters as the permission check, and the two traps the adapter is built around.
- [Example · Agno](https://attenu.io/docs/example-agno/): Agno teams with permissions: tool hooks on every member, delegation narrowed at the team boundary.
- [Example · Haystack](https://attenu.io/docs/example-haystack/): Haystack agent permissions: every Tool.invoke checked; an AgentTool handoff mints a narrower sub-agent.
- [Example · CAMEL-AI](https://attenu.io/docs/example-camel/): CAMEL-AI sub-agent permissions: AgentToolkit and Workforce handoffs narrowed, every tool call checked.
- [Example · Microsoft Agent Framework](https://attenu.io/docs/example-agent-framework/): Microsoft Agent Framework permissions as FunctionMiddleware: as_tool and handoff edges narrowed before the sub-agent starts.
- [Example · AG2](https://attenu.io/docs/example-ag2/): AG2 1.0 permissions through on_tool_execution middleware and a per-tool hook for auto-spawned subtasks.
- [Example · A2A](https://attenu.io/docs/example-a2a/): A2A (Agent2Agent) permissions across a hop: the signed delegation chain travels as an A2A extension; the remote agent runs with a subset of the caller's set.
- [Example · Langflow](https://attenu.io/docs/example-langflow/): A Langflow custom component that checks every tool invocation and narrows a downstream agent through a flow edge.
- [Example · Claude Agent SDK](https://attenu.io/docs/example-claude-agent-sdk/): Claude Agent SDK with permissions, live-verified: a real subagent over-reach denied.

## attenu-guard

- [TypeScript / Node.js](https://attenu.io/docs/typescript/): attenu-guard for TypeScript: the same enforcement and the same bundle format as the Python library, verified by cross-language fixtures; LangGraph.js adapter; npm install attenu-guard.

## attenu-derive

- [The engine](https://attenu.io/docs/derive/): How Attenu Derive works out each agent's permissions from your app, and what has been measured.
- [Threat model](https://attenu.io/docs/threat-model/): Trust boundaries, attacker model, five invariants with mechanism and test, residual risks.
- [Live enforcement](https://attenu.io/docs/live-enforcement/): Real applications denied mid-run on two models; permissions narrowing across a real handoff chain.
- [Onboarding](https://attenu.io/docs/onboarding/): Day-0 on an app the engine has never seen, and the measured curation share.
- [Operations](https://attenu.io/docs/operations/): Modes, rollback, custody, what leaves your environment.
- [What is proven](https://attenu.io/docs/evidence/): The evidence pack: every gate, its bound, and what is not met.
- [Security review](https://attenu.io/docs/security-review/): A structured self-review, single reviewer — stated as such.
- [Three frameworks, live](https://attenu.io/docs/frameworks-live/): CrewAI, LangGraph and ADK enforced on the same workload, no divergence.

## Site

- [Open source](https://attenu.io/oss/)
- [What Attenu is not](https://attenu.io/what-attenu-is-not/)
- [Cedar vs OPA vs Casbin vs attenu-guard: permissions for AI agents](https://attenu.io/compare/)
- [Changelog](https://attenu.io/changelog/)
- [Roadmap](https://attenu.io/roadmap/)
- [Blog](https://attenu.io/blog/)

- [We reviewed our own adapters like an attacker would. Here is what broke.](https://attenu.io/blog/adversarial-review-bug-hunt/): Last week we wired execution binding — the evidence layer that records what happened after a call was
- [What crosses an ADK transfer, and what should not](https://attenu.io/blog/adk-peer-transfer/): What ADK built well. Google's Agent Development Kit has the cleanest transfer model of the frameworks we
- [A receipt for what Claude Code gave the subagent](https://attenu.io/blog/claude-code-hooks-receipt/): What Claude Code built well. Of every agent framework we have integrated, Claude Code has the most complete
- [Per-subagent permissions in LangChain, without changing LangChain](https://attenu.io/blog/langgraph-subagent-middleware/): What LangChain built well. Middleware is the seam most agent frameworks are missing, and LangChain put it
- [How much, not just who: what an MCP server can check](https://attenu.io/blog/mcp-server-verifier/): What MCP built well. The authorization spec (2026-07-28) is careful about the oldest problem in delegated
- [Omnigent's budget is a count. Authority needs a ceiling.](https://attenu.io/blog/omnigent-policy-handler/): What Omnigent built well. Omnigent is a meta-harness: it drives Claude Code, Codex, Cursor, OpenCode, Pi and
- [Two agents in the Agents SDK, and the relation between them](https://attenu.io/blog/openai-agents-one-policy/): What they built well. The OpenAI Agents SDK has, quietly, the most complete set of capability