Every request enters Tenure through an authenticated token. Tenure resolves the precise context lanes that token is allowed to inherit, strips forbidden capabilities before the model ever encounters them, and traps unsafe tool calls before they can execute against your business systems.
Tenure sits on the model request path, outside the agent loop. Frameworks iterate. Models shift. The out-of-model policy boundary remains absolute.
Tenure injects precise structured beliefs instead of flattening loose conversation history into one retrieval pool. Organizational rules, team practices, project context, and user preferences remain scoped instead of being flattened into one retrieval pool.
Observe mode records what capabilities were supplied, what the model could see, what it invoked, which providers and models appeared, and how that behavior changes over time.
Once policy is active, Tenure records the policy version applied and the decisions it made, including capability filtering, release, block, and request denial.
A request can offer more capability than policy permits without making the entire request invalid. Tenure narrows the model's effective capability surface before inference, then checks returned invocations again on the way back.
Before inference, Tenure removes capability definitions the active policy does not allow. The model never sees them. The request can continue with the capability surface policy actually permits.
After inference, Tenure normalizes every structured invocation and checks it against policy again. Disallowed calls are withheld before they reach the application runtime.
If the caller explicitly requires a specific disallowed capability, or filtering makes an explicit request constraint impossible to satisfy, Tenure rejects the request instead of silently changing its meaning.
Tenure can observe how an agent is actually configured and used, collapse that activity into a reviewable behavioral profile, and turn the reviewed result into an enforceable policy.
The capabilities the application supplied and the subset Tenure exposed to the model. This is the agent's potential surface, not proof that every capability is needed.
Capabilities the model returned as structured calls, with invocation counts and first and last seen dates drawn from the observation window.
Invoked capabilities are proposed for the allowlist. Available but never invoked capabilities remain visible and unselected, making unnecessary exposure easy to remove.
The Agents view collapses high-volume observations into the signals needed to understand behavior and draft policy, while still keeping recent raw observations available for investigation.
See every capability observed as available to the model, which ones the model actually invoked, and which remained unused.
Invocation counts plus first and last seen dates make low-frequency but legitimate capabilities visible without relying on only the latest requests.
Track which providers and models appear on the token so routing behavior is visible alongside capability behavior.
Record per-request token usage and roll it up over time by agent, provider, and model for cost visibility and future consumption controls.
The agent detail view keeps the most recent observations available for drill-down, while policy drafting works from the aggregated capability profile rather than assuming the latest 100 requests represent the agent's full behavior.
Tenure keeps these concerns separate so high-volume behavioral logging does not have to serve as permanent audit evidence or long-term usage accounting.
What was supplied, exposed, and invoked; invocation arguments and call IDs; provider and model activity; counts and first or last seen dates. Granular, high volume, and time limited.
What shape does this agent's behavior have?Identity, authentication, policy version, filtering decisions, forced-capability denials, releases, and blocks. Durable evidence of what Tenure itself decided.
What did Tenure permit or prevent?Per-request token counts linked to the same request or observation when available, with independent retention and aggregation by agent, model, provider, and time window.
How much model capacity did this agent consume?The wire format differs by provider protocol, but Tenure reduces the lifecycle to the same small set of states before policy is evaluated.
The invocation is returned to your application runtime. What happens after that point belongs to your infrastructure, not to Tenure.
Policy says no. Tenure withholds the structured invocation and records the attempted call and enforcement decision.
When the caller explicitly requires a disallowed capability, Tenure rejects the request rather than silently altering what the caller asked the model to do.
Tenure's authority ends at release. It does not claim to know whether a released action succeeded, failed, was ignored, or produced a side effect after it reached the application runtime.
Tenure normalizes each supported ingress protocol into the same internal capability identities. Policy evaluation does not need to know which agent framework constructed the request or which provider-specific field carried the tool definition.
Protocol adapters understand provider wire formats. The enforcement core operates on canonical identities. Observation and enforcement share the same normalization logic, but runtime decisions never depend on querying historical observations.
| What context should this caller receive? | Scoped beliefs |
| What capabilities did the application offer? | Observation |
| What capabilities does the agent demonstrate it needs? | Observed invocation |
| What should the agent be allowed to do? | Reviewed policy |
| What did Tenure actually permit or prevent? | Audit |
Scoped beliefs supplies the right context. Observation builds the evidence. Policy turns evidence into a reviewed decision. Enforcement applies that decision on the request path. Audit proves what Tenure did.
Run Tenure locally, observe an agent's real capability surface, generate a policy draft, and enforce the reviewed policy without changing how the agent reasons.