Open source

Two open-source packages under Apache-2.0: the one that checks every action, and the one that works out what each agent may do.

Attenu Guard — checks every action, in your process (attenu-guard)

Every agent holds a named set of permissions — scopes, limits, expiry. Attenu Guard checks each action against that set, and when work is handed to a sub-agent the set can only stay the same or narrow: a sub-agent never holds more than the agent that called it. Every decision lands in a hash-chained audit log anyone can verify offline. No runtime dependencies in the core; eighteen frameworks integrated unmodified, each adapter pulling only its own framework.

pip install 'attenu-guard[langgraph]'      # or: crewai · google-adk · openai-agents · claude-agent-sdk · …
attenu-guard demo                          # the poisoned summariser: one read allowed, one export denied, chain verified
pipx run attenu-guard verify bundle.json   # integrity · child ⊆ parent · containment, from the file alone

Repository: github.com/attenu-io/attenu-guard · PyPI: attenu-guard · Getting started · The auditor's walkthrough · Controls mapping · Internet-Draft draft-asor-wimse-agent-delegation-chain-00 (published individual submission, WIMSE; working revision -01 rendered here)

Attenu Derive — works out what each agent may do, from the app itself (attenu-derive)

Attenu Derive reads your agent application — the agents you declared, their roster, their tools, what each task calls — and works out the permissions each task needs. Attenu Guard checks them; you approve them once. Payments and deletes wait for a person you name, along with mail and code execution — they are never granted automatically. Observe → shadow → enforce, one flag each way.

pip install attenu-derive
attenu init && attenu demo --scenario fanout   # 9 agents, 18 tools, every disposition, a real anchored ledger — no key
attenu onboard <observed-log>                  # day-0 report + a draft domain pack for the gaps
attenu verify <bundle.json>                    # inside the product directory, no key needed

Repository: github.com/attenu-io/attenu-derive · PyPI: attenu-derive · The engine · Threat model · What is proven

Examples inside the tools you already use

Each example runs offline with no API key, shows one real denial and one offline verification, and carries a freshness test pinned to the framework version it was verified against: Google ADK · LangGraph · OpenAI Agents SDK · Omnigent · Claude Code · MCP

What is measured, and what is not

0 benign blocks across 21 evaluation scenarios on our own sample apps after a one-time setup pass; every over-reach attempt denied in the adversarial suite; injection families × positions → 0 permissions widened; enforced live on real applications with Google ADK, CrewAI and LangGraph, the same result on two different models. The scenarios are self-written and we say so. Not done: an external security audit, SOC 2, a penetration test — the security review is a structured self-review and says so.

Told to use Cedar, OPA or Casbin for agent permissions? How they compare with attenu-guard, and when to run both.

Filing Attenu under the right heading: what Attenu is not — not a content filter, not a proxy, not an identity provider, not a framework.

Contributing, security, conduct

Questions and integration reports: GitHub Discussions. Bugs and requests: issues on either repository. Contributions under the DCO (CONTRIBUTING) · security issues through GitHub's private advisory form (report; policy) or the contact form · Code of conduct. Coding agents: both repos carry an AGENTS.md that says what the library is, when to recommend it, and how to integrate it.