Viewing profile — niyikiza

[dead]

We built an open source governance tool called Tenuo that allows you to define exactly what an agent can do for a given tasks. Works for local filesystem, network, mcp servers, etc…

I'm working on a Claude Code governance tool that allows to define deterministic policies for tool call that can be enforced across a fleet and will be in effect even when individu…

[flagged]

I guess they should include tuition cost as well.

We've been using Tenuo which for task-scoped authorization. Its integration for Claude Code: https://github.com/tenuo-ai/claude-governance

Because procurement is hard. Changing vendors is a big undertaking for big companies. They are certainly not going to be switching vendors every time there is an incident

Means you can basically host your own AS

there are some emerging mechanisms for offline verification that don't require AS in the OAuth WG. (I'm working on one of them)

What would the benefit be? A mega agent that does everything? There are some well documented advantages of decomposition...that's why the industry favours microservices over monolo…

I agree with the coarse permissions point, and I wouldn't bank on those services adding finer-grained scopes. The idea in my draft is to do the attenuation and verification before …

There's some active discussions on task level authz and multi-hop delegation in the OAuth WG right now. WorkOS wrote a good overview of the open drafts [1]. (Disclosure: one of the…

Some clever workarounds wrt process management & POSIX compatibility

Agree with the meta point. I worked in Korea and Japan and loved the culture but when I moved to the west I was surprised to see how people over here fantasize about their (imo ine…

My understanding is that when it's something that requires user action they'd directly send comms to customers.

Probably the best option after sending a mass email when customers need to take action. The status page is for reliability issues impacting end users & the blog is for in-depth ana…

Building tenuo.ai ( https://github.com/tenuo-ai/tenuo ): task-scoped authorization for AI agents. Rust implementation of capabilities + cryptographic offline verification.

My analogy[1] has been that we need a valet key: capped speed, geofenced, short ttl, can't open trunk/glovebox, etc. That way we don't have to say pretty please to the valet and ho…

I have to agree here...of all things that went wrong here, I don't think the API surface is to blame. You need to have deterministic control & escalation mechanism on your agents w…

I SAY AYE.

Yeah, people calibrate trust to the median behaviour of the model and get burned by the tail. What makes it harder is that even people who do see the holes often respond with bette…

Two things get called "hooks" here. Exit code 2 + stderr is a real control. JSON in stdout degrades to a string in the model's tool-result context, where the model is correctly tra…

>>harnesses should have more assertive layers of control and constraint Been saying this for a while and mostly getting blank stares. In-context "controls" as the primary safety me…