warrantgen

Record what your AI agent actually does, then get the narrowest Tenuo warrant that still allows it: signed, per step, per sub-agent, with tests that keep it honest in CI.

Writing least-privilege warrants by hand is the slow part of adopting Tenuo. A real Temporal agent needed ~290 lines of hand-written warrant, key and audit code. warrantgen infers the same constraints from recorded runs, and on that agent's held-out runs it allows every legitimate call and denies every injected secret read.

Try it in five commands, no network or account: examples/demo records a small agent, infers its warrants, and stops a prompt injection the agent fell for.

For actions that can't be undone, examples/refund-agent caps refunds to recorded behavior, gates each one behind a signed human approval, and runs 16 failure scenarios: injection, approval bypass, expired approvals, malformed arguments, timeouts.

How it works

flowchart TD
    A["Your agent<br/>LangGraph or Temporal"] -- "Recorder<br/>(no warrant needed)" --> T[("traces.jsonl")]
    T --> Q{"Quarantine runs that touched<br/>.env · .. · keys · metadata IPs"}
    Q -- "clean runs" --> I["infer<br/>rules per step"]
    I --> W["Signed warrant<br/>warrantgen.mint"]
    I --> Y["tenuo-cli template<br/>warrantgen template"]
    I --> C["Per-hop delegation chain<br/>warrantgen chain"]
    I --> P["pytest tests<br/>warrantgen test"]

1. Record tool calls with a LangChain callback or Tenuo's Temporal audit_callback. Each call is tagged with its run and its step (a LangGraph node path, or the warrant that checked it on Temporal).
2. Quarantine any run that touched a secret file, a .. path or a private host. It is never learned from.
3. Infer one rule per argument from several runs: what's fixed, what changes per run, what's free text.
4. Use the rules: mint a warrant, write a tenuo-cli template, mint a delegation chain, or generate tests.

What inference looks like

Rules inferred from 15 recorded runs of a real agent on 3 sites, next to the warrant its authors wrote by hand (the fetch.url row comes from the LangGraph example):

Reads generalize to their folders or URL prefix (several hosts become AnyOf of one UrlPattern per host); writes keep their exact files. Money-like arguments (amount, price, cents, ...) never get headroom.

Per-hop delegation chains

When a LangGraph supervisor hands work to sub-agents, warrantgen chain builds one warrant per hop from the recorded node paths. Every child is minted from its parent through Tenuo's own delegation API, so Tenuo checks that each hop only narrows.

flowchart TD
    R["root, signed by the issuer<br/>search · fetch · write_file"]
    R --> T["team<br/>search · fetch"]
    T --> S["team/researcher<br/>search · fetch under docs.python.org/3/library/"]
    R --> W["writer<br/>write_file: this run's report only"]
    S -.-x SD["write_file: denied"]
    W -.-x WD["fetch: denied"]

Tested under real TenuoTool enforcement with full chains: each sub-agent runs its recorded calls, and none can use a sibling's tools. If Tenuo refuses to narrow an argument, it keeps its parent's constraint and chain says which. Since tenuo 0.3.6 that includes a URL rule listing several hosts: every child keeps the parent's full host list.

Results on a real agent

The test agent is a Temporal workflow that opens pull requests to fix a website, minting one warrant per phase. 15 recorded runs: 3 sites × 5 behaviors, including a prompt injection that tries to read .env and ../payments-api/.env. Details in examples/seo-agent.

Quickstart

pip install "warrantgen[langchain]"

Record (several runs with different inputs: one run can't tell a fixed value from a per-run one):

# LangChain or LangGraph
from warrantgen.record_langchain import Recorder
graph.invoke(state, {"callbacks": [Recorder("traces.jsonl")]})

# Temporal, through Tenuo's plugin (dry_run=True with a broad warrant to observe)
from warrantgen.record_temporal import TemporalRecorder
TenuoPluginConfig(..., audit_callback=TemporalRecorder("traces.jsonl"))

Then:

warrantgen infer traces.jsonl                          # rules per step, plus quarantined runs
warrantgen template traces.jsonl --step write --set repo=acme/site --set paths=a.txt,b.txt --out write.yaml
tenuo-cli warrant issue --template write.yaml --holder agent
warrantgen chain traces.jsonl --from-run RUN           # per-hop tree, minted and checked by Tenuo
warrantgen test traces.jsonl --out test_warrants.py    # recorded calls allowed, near-misses denied

In Python: warrantgen.infer, warrantgen.mint, warrantgen.chain.mint_chains. Pass gates=["issue_refund"] and approvers=[key.public_key] to mint to require a signed approval on every call to those tools.

Test the warrants you ship

warrantgen test traces.jsonl --warrant-for my_warrants:warrant_for --known-looser size --out tests/test_recorded_calls.py

The generated file imports your warrant_for(step, values, issuer, holder_public_key) instead of warrantgen, so you can commit it with only tenuo and pytest as dependencies. Each step's recorded calls must be allowed, and near-misses must be denied: one argument just outside its rule, or a tool the step never used. --known-looser marks arguments you loosen on purpose as strict expected failures, so tightening one later flags the stale mark.

Rules

Override a guess with --var ARG (treat as per-run) or --exact ARG (pin it).

Status

Early and opinionated. Tested against tenuo 0.3.6 and 0.3.7 (the versions the pin allows) and the local-cli stack (tenuo#942 to #952). Limits and the Tenuo issues found along the way are tracked in UPSTREAM.md.

License

Apache-2.0