AI
Why Workload Identity Breaks for Agentic Workflows
Workload identity was built for deterministic services. A pod runs, you know what it does, and its deploy-time identity matches that intent. Agentic workflows break that assumption. They reason at runtime, spawn sub-agents on the fly, and their behavior at execution cannot be predicted at deploy time. Granting them the same ambient authority granted to static services is what produces confused deputy attacks.
“we need deterministic predictable and auditable authorization” — Niki Aimable Niyikiza
Derived Authority and the Delegation Problem
Policy engines, output filters, and sandboxes all miss the same gap: none encode the delegation chain. They reason from workload identity at deploy time or model output at inference time, with no context of what authority passed from agent A to agent B to reach the execution point.
“we need deterministic predictable and auditable authorization” — Niki Aimable Niyikiza
The concept behind the fix is 60 years old. Dennis and Van Horn introduced capability-based authorization to address confused deputy attacks. Google’s Macaroons (2014) added attenuating caveats to tokens. A March 2024 DeepMind paper, “Defeating Prompt Injection by Design,” applied the model to agentic workflows. A February 2025 follow-up repeated the call.
The Tenuo Warrant: Six Properties of Capability-Based Authorization
The Tenuo warrant has six properties: signed by the issuer, scoped to the task (if an action isn’t encoded, the agent can’t take it), ephemeral by design, holder-bound (proof of possession required), offline-verifiable without a central server, and delegation-aware. That last property is the core of the model. As warrants pass down a multi-agent chain, capabilities can only shrink.
“the warrant of the child agent can never exceed the scope of the parent agent” — Niki Aimable Niyikiza
This principle, monotonic attenuation, means the whole workflow’s ceiling is set at the top. As a byproduct, every delegation step produces a cryptographic audit record: who approved what, who initiated the task, who delegated to which agent.
“the blast radius is frozen when you’re starting your task” — Niki Aimable Niyikiza
Live Demo: SOC Triage Workflow with LangGraph
The demo uses a two-agent LangGraph setup: a triage agent and an investigation agent, both working an incident on the auth service. The SOC lead mints a broad warrant, hands it to the triage agent, which then narrows scope before delegating down. In the SOC triage warrant delegation demo (13:00), replacing LangGraph’s default tool node with Tenuo’s takes one line of code. When a prompt injection in the logs directs the investigation agent to read a vault credential path, Prompt-injection vault-read blocked (14:28) — the path was never in the warrant. Same outcome when the agent is tricked into calling evil-attacker.com: the triage agent stripped send-HTTP from the sub-warrant, so HTTP exfiltration to evil-attacker.com blocked (15:15) with cryptographic proof.
Deployment Models and Real-World Constraint Gaps
Tenuo ships four deployment modes: in-process middleware (nine frameworks, including CrewAI, A2A, and Temporal), sidecar via Envoy, an API gateway that reads warrants from HTTP headers, and an MCP proxy. Companies with existing agent infrastructure can use the gateway without rewrites.
“tenure is not trying to solve prompt injection. We’re trying to constrain the agent at execution time even if it is prompt injected” — Niki Aimable Niyikiza
Path traversal and URL encoding exposed a gap pure constraint logic can’t close. Tenuo now operates three layers: logical matching, a normalized path/URL layer, and a third where the warrant system and the sandbox share the same runtime model. That last layer is open research.
Q&A
How do you determine the scope of the token issued to the child agent at runtime — is it determined deterministically or can the LLM interpret what scope is needed? The top-level warrant is defined deterministically (by a human or a fixed process), and sub-agent scope is either set by the orchestrator at runtime or gated by an approval key pair — but the mathematical guarantee holds either way: no sub-agent can exceed the parent’s frozen scope. ▶ 22:51
Warrants aren’t secrets — how do you authenticate the agents? The warrant travels in an envelope that includes signatures proving it was issued by the root key and is being presented by the correct holder (proof-of-possession via private key), so the verifier runs two checks: constraint authorization and cryptographic provenance. ▶ 24:34
How do you map these capabilities to domain-specific permissions like OAuth, AWS IAM, or other existing authorization systems? Tenuo sits in front of existing IAM (AWS, GCP, OAuth) and checks whether the API call is in the warrant before it reaches the cloud’s own authorization layer — the constraint language supports regexes and CEL, and can match MCP tool names, URL hosts, paths, or arbitrary arguments. ▶ 25:52
Notable Quotes
the warrant of the child agent can never exceed the scope of the parent agent Niki Aimable Niyikiza · ▶ 10:36
we need deterministic predictable and auditable authorization Niki Aimable Niyikiza · ▶ 4:30
tenure is not trying to solve prompt injection. We’re trying to constrain the agent at execution time even if it is prompt injected Niki Aimable Niyikiza · ▶ 19:06
the blast radius is frozen when you’re starting your task Niki Aimable Niyikiza · ▶ 11:34
Key Takeaways
- Scope agent warrants to the exact task at hand — never grant workload-level ambient authority to agentic workflows.
- Enforce authorization at the execution layer, not the model output layer; deterministic controls survive prompt injection.
- Monotonic attenuation guarantees that no sub-agent in a delegation chain can exceed the authority of its parent.