TEND / Security
What TEND protects, and what it doesn’t
Read this before you put anything real behind TEND. The beta is for controlled testing with fictional data.
What it does (tested)
What it does (tested)
Asks before acting
A wrapped action runs only after TEND allowed it, by a rule or by a person, and then only once, with exactly the tool, action and text that were approved. A changed request, a reused or expired approval, or a revoked key is refused.What it does (tested)
Fails closed
If TEND can’t be reached, answers with an error or its database is unavailable, the action does not run. An unreadable rule set denies everything.What it does (tested)
One policy for many agents
A central policy applies to every agent assigned to it from the moment it changes. An agent’s own rules can make a governed action stricter, never looser.What it does (tested)
Looks at arguments
A rule can depend on what a tool is called with. The approval is bound to those exact arguments; a missing or malformed argument never satisfies a condition.What it does (tested)
Runs each call at most once
Allowed calls are authorized and spent in one step. A retry after a lost answer, or the same call delivered twice, is refused rather than run again.What it does (tested)
Keeps a record
Requests, decisions, policy changes and revocations go to an append-only log, each entry hash-chained to the one before it, so changes show up when the chain is checked.What it does (tested)
Separate identities
Each agent has its own key. Revoking one does not affect another, and no agent can see or use another’s approvals.
What it doesn’t do
What it doesn’t do
Only code that asks
TEND is a checkpoint, not a sandbox. An agent that skips the wrapper, or holds real credentials for email, a database or payments, can act without TEND, and TEND will not know. For real enforcement the credential must live behind TEND’s gateway.What it doesn’t do
Same machine, same user
Processes running as your user can read each other’s environment and files. TEND is not an isolation boundary on your computer.What it doesn’t do
No roles or two-factor sign-in
Each account has one workspace and everyone in it is an operator. No SSO, no 2FA, no teams yet.What it doesn’t do
The agent describes its own call
Conditions are checked against the arguments the agent sends. A modified or malicious agent could describe one call and make another.What it doesn’t do
Long values are summarized
Strings over 256 characters and lists over 50 items reach the rules as a hash and a length, so a condition on them does not match.What it doesn’t do
Detects tampering, doesn’t prevent it
Someone who can write to the database can rewrite history and recompute the chain. Keep the head hash somewhere outside TEND to compare later.What it doesn’t do
Can’t judge meaning
TEND binds an approval to exactly what was asked. If code describes one thing and does another, TEND cannot tell, and a tired person can be misled by the text shown.What it doesn’t do
At most once, not exactly once
If an agent crashes after spending an approval, the action ran zero times and only a missing report shows it.What it doesn’t do
No sequence rules or content scanning
No rules over sequences of calls, no content scanning and no prompt-injection detection.What it doesn’t do
No independent review yet
TEND has had no independent security review yet, and it may be unavailable at times. The dashboard must be open to see what waits for you.
Try to break it
Find a way to run a call TEND didn’t approve, reuse an approval, or edit the log unseen. Use your own instance and fictional data, and tell us privately with the steps.