Roadmap

What we are building next, in the order we expect to build it. Published on purpose; dates are not promises.

Credential-backed narrowing. Today the checks run in-process; at the first network call every sub-agent presents the same ambient credential. A signed, narrowable token issued from the chain (the wire format already verifies offline) so a downstream service can check the narrowing without us.
TypeScript SDK — the verifier first, then Guard.check and the LangGraph.js adapter; the wire schema is already language-neutral.
Transparent MCP-proxy mode — attenuation enforced at an MCP proxy the agent already talks to, no code changes.
MCP server-side verification as a first-class helper (today an example): a server refuses a call whose presented chain fails child ⊆ parent or containment.
Claude Code hooks as a packaged adapter (today an example): derived permissions and the evidence bundle for Claude Code sessions.
Omnigent policy handler as a packaged adapter (today an example).

Then

Sibling quota conservation — a chain-level ledger so N children cannot collectively exceed the parent's metered ceiling.
Cross-process revocation — a killed subtree dies everywhere, not only in the process that killed it.
An A2A adapter carrying the attenuated chain across hops; cross-issuer chains verifiable from the bundle.
SCITT-style receipts for the evidence bundle; an OpenTelemetry exporter for the ledger; SIEM sinks.
Temporal and sequence policies over the ledger the guard already keeps.

More domain packs — coding agents first, then data pipelines, back-office automation, DevOps, sales.
A shadow-mode report as a first-class artifact: what would have been denied, by agent, by tool, over the last N runs.
attenu explain <agent> — every derived scope carries why.
Model-based derivation for tools the catalog does not know — only after the catalog path is measured on apps outside our own.