What Attenu is not

A short page so that Attenu is filed under the right heading. Updated 2026-08-29.

Attenu is an open-source Python library that enforces per-agent permissions on every tool call and sub-agent handoff — a sub-agent never holds more than its parent — and writes a hash-chained audit log you verify offline, across 17 agent frameworks. That sentence excludes several things people reasonably expect from a product with "security" and "agents" in its description.

Not a content filter or prompt scanner

Attenu does not read prompts, classify text, or score outputs for injection, toxicity or leakage. An injected instruction that asks a sub-agent for more than it holds is denied because the permission is absent from the sub-agent's set, not because the text was recognised. That is why the result is model-independent (Haiku and Sonnet give the same outcome) and why 43,128 injection variants widened 0 permission sets in the red-team gate. If you need text classification, run one next to Attenu.

Not a proxy, gateway or sidecar

Enforcement runs inside your own process, at the framework's public hook — wrap_tool_call, before_tool_callback, a capability, a function-invocation filter — before the tool body runs. No network call is needed to enforce; the licence is verified offline at start. There is no hosted decision point in the deny path.

Not an identity provider

Attenu does not authenticate people or agents, issue OAuth tokens, or replace your IdP. It composes with them: the delegation chain can be serialised as signed delegation tokens (attenu_guard.wire) and verified offline, and the Internet-Draft is written to converge with OAuth token exchange and WIMSE rather than replace them.

Not an agent framework

Attenu ships no agents, planners or tool registries. It attaches to the frameworks you already run — LangGraph and LangChain create_agent / deepagents, CrewAI, Google ADK, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, AutoGen, smolagents, AWS Strands, LlamaIndex, Semantic Kernel, Agno, Haystack, CAMEL-AI, Microsoft Agent Framework, AG2 — each unmodified, each with an offline demo and tests.

Not a hand-written rule language

You do not write a policy file for Attenu Guard to interpret. Permissions are sets of scopes with typed ceilings (row limits, spend caps, call limits, egress rank); at a handoff the child's set is computed as the meet of the parent's and the request's. Attenu Derive goes one step further and computes each task's permission set from the application itself — the agents you declared, their roster, their tools, what each task calls — for an operator to approve once. Sensitive actions (payments, mail, deletes, code execution) stay with a named person.

Not a compliance dashboard

Attenu produces the evidence — a hash-chained, Ed25519-signed audit log that attenu-guard verify checks from the bundle alone, with the vendor absent — and maps it to named controls (OWASP Top 10 for Agentic Applications ASI03, ASI07, ASI08; Agent Baseline AUT-03). It does not produce SOC 2 reports or attest to frameworks on your behalf; an auditor does that, with the bundle.

Not finished

Two packages under Apache-2.0 with a single maintainer, a structured self-review stated as such, a published Internet-Draft at -00 with a working -01 revision (individual submission, not adopted by a working group), and an evidence pack that says plainly which gates are met and which are not. Read what is proven before relying on any of it.