niyikiza

9 ms·

31.
AI agent is authorized to do everything wrong(tenuo.ai)
6 points by niyikiza 7mo ago|0 comments
32.
Anthropic is joining the ConnectRPC project(github.com)
5 points by niyikiza 7mo ago|0 comments
33.
by niyikiza 7mo ago
We've been working on that with tenuo: https://github.com/tenuo-ai/tenuo Task-scoped "warrants", attenuating with delegation, and enforced cryptographically at tool call. Macaroons/Biscuits for agen
34.
by niyikiza 7mo ago
Cool project! I went to a Korean university more than 190 years ago and can only speak basic Korean but going through your examples seem to be improving my Korean vocabulary!
35.
by niyikiza 7mo ago
We've been working on a warrant model that ensures task-scoped authorization: constrain your agents to specific tools and specific arguments, cryptographically enforced at the MCP tool boundary. Even a fully compromised agent can'
36.
by niyikiza 7mo ago
The boundary also needs to hold if the agent is compromised. Proxying keys is the right instinct. We took the same approach at the action layer: cryptographic warrants scoped to the task, delegation-aware, verified at the MCP tool boundary
37.
by niyikiza 7mo ago
The two-layer framing is right. Sandbox-exec contains local blast radius, and that's important. But if the agent already has a credential in memory, sandboxing the filesystem doesn't help. I've been working on a primitive for
38.
by niyikiza 8mo ago
Good distinction, but I wonder if it's worth going further: context integrity may be fundamentally unsolvable. Agents consume untrusted input by design. Trying to guarantee the model won't be tricked seems like the wrong layer to
39.
by niyikiza 8mo ago
Right on. Human-in-the-loop doesn't scale at agent speed. Sandboxing constrains tool execution environments, but says nothing about which actions an agent is authorized to take. That gets even worse once agents start delegating to othe
40.
by niyikiza 9mo ago
Spot on. You could argue that most companies buying B2B SaaS could almost always build a clone internally but they need someone to assume SLA and liability.
41.
Show HN: Tenuo – Capability-Based Authorization (Macaroons for AI Agents)
2 points by niyikiza 9mo ago|0 comments
42.
by niyikiza 9mo ago
The Agent Swarm section is fascinating. I'm working on authorization for multi-agent systems so this is relevant to my interests. Lots of interesting parallels to capability-based security models.
43.
The Republic of Bots: OpenClaw and the Authorization Gap(niyikiza.com)
2 points by niyikiza 9mo ago|0 comments
44.
by niyikiza 9mo ago
Exactly ... and that's why I'm skeptical of "AI verifies AI" as the primary safety mechanism. The verifier for moving money should be deterministic: constraints, allowlists, spend limits, invoice/PO matching, etc. T
45.
by niyikiza 9mo ago
A worker agent doesn't mint warrants. It receives them. Either it requests a capability and an issuer approves, or the issuer pushes a scoped warrant when assigning a task. Either way, the issuer signs and the agent can only act within
46.
by niyikiza 9mo ago
Yep ... that's exactly the direction. Think "default deny + step-up," not "grant everything up front." You keep a coarse cap (e.g. email read/write, invoice pay) but each task runs under a narrower, time-boxed
47.
by niyikiza 9mo ago
You've got the model right. And saving prompt logs does help with reconstruction. But warrants aren't just "more audit data." They're an authorization primitive enforced in the critical path: scope and constraints a
48.
by niyikiza 9mo ago
Working on this problem: https://github.com/tenuo-ai/tenuo Different angle than policy-as-YAML. We use cryptographic capability tokens (warrants) that travel with the request. The human signs a scoped, time-bound autho
49.
by niyikiza 9mo ago
Right, the non-deterministic layer can't be the one deciding scope. That's the human's job at the root. The LLM can request a narrower scope, but attenuation is monotonic and enforced cryptographically. You can't sign a
50.
by niyikiza 9mo ago
Tokens + filters work for single-agent, single-hop calls. Gets murky when orchestrators spawn sub-agents that spawn tools. Any one of them can hallucinate or get prompt-injected. We're building around signed authorization artifacts ins
51.
by niyikiza 9mo ago
This is the problem we're working on. When orchestrators spawn sub-agents spawn tools, there's no artifact showing how authority flowed through the chain. Warrants are a primitive for this: signed authorization that attenuates at
52.
by niyikiza 9mo ago
Similar space, different scope/Approach. Tenuo warrants track who authorized what across delegation chains (human to agent, agent to sub-agent, sub-agent to tool) with cryptographic proof & PoP at each hop. Trace tracks provenance
53.
by niyikiza 9mo ago
You'd be surprised to see how often we're seeing those types of semantic attack vulnerabilities in Agent frameworks: https://niyikiza.com/posts/map-territory/
54.
by niyikiza 9mo ago
> if you signed the document, you own its content. Versus some vendor-provided AI Agent which simply takes action on its own Yeah that's exactly the I think we should adopt for AI agent tool calls as well: cryptographically signed,
55.
by niyikiza 9mo ago
Agree ... retention is mandatory. The article argues you should retain authorization artifacts, not just event logs. Logs show what happened. Warrants show who signed off on what
56.
by niyikiza 9mo ago
You're right, they should be responsible. The problem is proving it. "I asked it to summarize reports, it decided to email the competitor on its own" is hard to refute with current architectures. And when sub-agents or third-
57.
The Hallucination Defense(niyikiza.com)
56 points by niyikiza 9mo ago|156 comments
58.
by niyikiza 9mo ago
Author here. Correction: I accidentally submitted the Substack link instead of the full technical write-up. You can read the complete post with all the attack vectors here: https://niyikiza.com/posts/semantic-attacks&#x
59.
Semantic Attacks: Exploiting What Agents See(niyikiza.substack.com)
2 points by niyikiza 9mo ago|1 comments
60.
by niyikiza 9mo ago
Injecting context via tool outputs to hit Layer 6 is a clever way to leverage the model spec. The gap I keep coming back to is that even at Layer 6, enforcement is probabilistic. You are still negotiating with the model's weights. &quo

More ›