Agent identity
Bind every governed request and active policy to an authenticated workload token.
Agentic application security
How Tenure maps to the OWASP Top 10 for Agentic Applications.
Tenure puts identity, scoped context, capability policy, workflow preconditions, and audit controls on the model request path. This page shows where those controls directly address risk, where they reduce exposure, and where other security controls remain necessary.
This is a product capability mapping, not a certification or claim that Tenure replaces a complete application security program.
Tenure's control model 01 02 03 04 05
Five controls recur across the framework.
Scoped context
Limit the organizational, team, project, and user state eligible for a request.
Capability filtering
Remove forbidden tools before inference and verify returned actions again.
Evidence preconditions
Require earlier results and argument conditions before downstream actions continue.
Runtime audit
Record identity, policy version, capability decision, evidence result, and outcome.
Coverage summary
Tenure controls authority, not every source of compromise.
A hijacked or mistaken model may still form a harmful goal. Tenure limits whether the resulting action can cross the governed boundary.
Direct controlRisk reductionComplementary controls required
OWASP riskCoveragePrimary Tenure control
ASI01 Agent Goal HijackRisk reductionAction enforcement
ASI02 Tool Misuse and ExploitationDirect controlTool policy and preconditions
ASI03 Identity and Privilege AbuseDirect controlIdentity-bound policy
ASI04 Agentic Supply Chain VulnerabilitiesComplementaryAuthority containment
ASI05 Unexpected Code ExecutionRisk reductionInvocation policy
ASI06 Memory and Context PoisoningDirect and partialScoped memory provenance
ASI07 Insecure Inter-Agent CommunicationRisk reductionAgent identity and scopes
ASI08 Cascading FailuresRisk reductionPer-action checks
ASI09 Human-Agent Trust ExploitationRisk reductionEvidence and audit
ASI10 Rogue AgentsDirect, conditionalRuntime enforcement
ASI01 to ASI03
Constrain the goal, tool, and identity path.
ASI01RISK REDUCTION
Agent Goal Hijack
A manipulated model may pursue a goal the application never intended.
What Tenure controls
Tenure evaluates the resulting structured action against policy. Forbidden tools are hidden, returned calls are checked, and missing evidence blocks dependent work.
What remains
Tenure does not prevent prompt injection or prove that the model's internal objective is benign.
ASI02DIRECT CONTROL
Tool Misuse and Exploitation
An agent uses an available capability outside its intended purpose or conditions.
What Tenure controls
Per-agent allowlists, exposure filtering, invocation checks, argument conditions, workflow preconditions, and independent decisions for multiple calls.
What remains
Tools executed through direct or unobserved side channels are outside the governed path.
ASI03DIRECT CONTROL
Identity and Privilege Abuse
An agent uses authority that belongs to another actor or exceeds its assigned role.
What Tenure controls
Separate agent tokens, identity-bound policy, scoped memory access, policy versions, revocation, and attributable decisions.
What remains
Direct provider credentials and direct tool credentials can bypass Tenure if they remain available to the agent.
Tenure does not need to decide whether the model was hijacked before it can deny an action the agent was never authorized to perform.
ASI04 to ASI06
Contain compromised components, execution, and context.
ASI04COMPLEMENTARY
Agentic Supply Chain Vulnerabilities
A model, package, plugin, tool, or integration introduces compromised behavior.
What Tenure controls
Tenure can limit the governed authority available to a compromised component and block new tool transitions outside policy.
What remains
Package integrity, provenance, dependency scanning, model artifacts, CI security, and MCP server implementation security require dedicated controls.
ASI05RISK REDUCTION
Unexpected Code Execution
An agent causes code or commands to run beyond the application's intended execution path.
What Tenure controls
Tenure can deny an execution tool, constrain its structured arguments, or require evidence before release.
What remains
Broad shell tools remain broad authority. Sandboxing, workload isolation, command inspection, and operating-system controls are still necessary.
ASI06DIRECT AND PARTIAL
Memory and Context Poisoning
Manipulated memory or context changes future reasoning and actions.
What Tenure controls
Scoped eligibility, source records, lifecycle history, review controls, supersession, token-level access, and an audit of injected beliefs.
What remains
Provenance does not establish that every external document or tool result is true.
ASI07 to ASI10
Limit propagation across agents, systems, and people.
ASI07RISK REDUCTION
Insecure Inter-Agent Communication
Agents exchange instructions or state without reliable identity, scope, or trust boundaries.
What Tenure controls
Distinct agent tokens, different policies, scoped context, governed handoff tools, and attributable audit records.
What remains
Message buses, files, or service calls that bypass Tenure need their own authentication and authorization.
ASI08RISK REDUCTION
Cascading Failures
One bad decision propagates through a multi-step or multi-agent system.
What Tenure controls
Independent action decisions, required prerequisites, field checks, and policy boundaries that stop unsupported downstream actions.
What remains
Rate limits, circuit breakers, transactions, rollback, queue isolation, and disaster recovery remain infrastructure responsibilities.
ASI09RISK REDUCTION
Human-Agent Trust Exploitation
A persuasive agent causes a person to approve or perform an unsafe action.
What Tenure controls
Reviewers can inspect agent identity, exposed tools, attempted actions, evidence paths, and the policy behind a decision.
What remains
Tenure does not identify every deceptive statement or guarantee that a human interprets evidence correctly.
ASI10DIRECT, CONDITIONAL
Rogue Agents
An agent acts outside its assigned purpose, policy, or operator intent.
What Tenure controls
Identity-bound policy, default-denied tools, pre-inference filtering, returned-action enforcement, evidence requirements, audit, and token revocation.
What remains
Consequential requests and actions must pass through Tenure. An ungoverned execution path remains a bypass.
Architecture boundary 01AgentAuthenticated identity → 02TenureContext and capability policy → 03ModelReasoning and proposed action → 04TenureEvidence and invocation checks → 05RuntimeReleased actions only Governed Bypass
Coverage depends on the path the action takes.
Requests through Tenure
Supported model traffic, structured tool calls, returned results, and evidence relationships can be observed and enforced.
Requests around Tenure
Direct provider credentials, direct tool execution, arbitrary network calls, and external messages require separate controls.
Deployment checklist
Make the enforcement boundary complete.
01
Give each agent a separate authenticated token.
02
Route every supported model request through Tenure.
03
Remove direct provider and tool credentials where possible.
04
Observe representative successful, failed, and recovery workflows.
05
Review proposed tools, arguments, and evidence preconditions.
06
Publish policy and test intentionally disallowed actions.
07
Monitor Audit for filtering, denials, and failed preconditions.
08
Pair Tenure with sandboxing, supply-chain, network, and conventional application controls.
Control agent authority
Make unexpected behavior unable to create unexpected authority.
Observe the workflows your agents actually run, review the authority they require, and enforce that boundary before actions reach your systems.
Read the OWASP Top 10 for Agentic Applications for 2026 →