What Attenu is not
A short page so that Attenu is filed under the right heading. Updated 2026-09-28.
Attenu is an open-source Python library that enforces per-agent permissions on every tool call and sub-agent handoff — a sub-agent never holds more than its parent — and writes a hash-chained audit log you verify offline, across 19 agent frameworks and the A2A protocol. That sentence excludes several things people reasonably expect from a product with "security" and "agents" in its description.
| Not this | What it is instead |
|---|---|
| A content filter or prompt scanner. Attenu does not read prompts, classify text, or score outputs for injection, toxicity or leakage. | An injected instruction that asks a sub-agent for more than it holds is denied because the permission is absent from the sub-agent's set, not because the text was recognised. The result is model-independent: Haiku and Sonnet give the same outcome. |
| A proxy, gateway or sidecar. There is no hosted decision point in the deny path. | Enforcement runs inside your own process, at the framework's public hook (wrap_tool_call, before_tool_callback, a capability, a function-invocation filter), before the tool body runs. |
| An identity provider. Attenu does not authenticate people or agents, issue OAuth tokens, or replace your IdP. | It composes with them: the delegation chain can be serialised as signed delegation tokens (attenu_guard.wire) and verified offline; the Internet-Draft is written to converge with OAuth token exchange and WIMSE, not to replace them. |
| An agent framework. Attenu ships no agents, planners or tool registries. | It attaches to the frameworks you already run, 19 of them and the A2A protocol, each unmodified, each with an offline demo and tests: integrations. |
| A hand-written rule language. You do not write a policy file for Attenu Guard to interpret. | Permissions are sets of scopes with typed ceilings (row limits, spend caps, call limits, egress rank); at a handoff the child's set is computed as the meet of the parent's and the request's. Attenu Derive computes each task's permission set from the application itself. |
| A compliance dashboard. It does not produce SOC 2 reports or attest to frameworks on your behalf. | It produces the evidence: a hash-chained, Ed25519-signed audit log that attenu-guard verify checks from the bundle alone, with the vendor absent, mapped to named controls (OWASP Top 10 for Agentic Applications ASI03, ASI07, ASI08; Agent Baseline AUT-03). An auditor does the attesting, with the bundle. |
Not finished
Two packages under Apache-2.0 with a single maintainer, a structured self-review stated as such, a published Internet-Draft at -01 (individual submission, not adopted by a working group), and an evidence pack that says plainly which gates are met and which are not. Read what is proven before relying on any of it.