TEND / Threat model

What TEND defends against

The trust boundary, what it stops, what it doesn’t, and what it assumes.

The trust boundary

Agent process

Untrusted. Holds only its TEND key.

agent key

TEND server

Trusted. Decides, records, holds gateway credentials.

credential

Tool APIs

Trusted to honour idempotency keys.

session

Operator browser

Approves. Never sees tokens or credentials.

TrustedUntrusted

A changed request after approval
Approvals are bound to the exact agent, tool, action, resource and detail; any difference is refused.
Replays and double delivery
An approval is spent in one atomic update; of concurrent attempts, one runs.
Another agent’s approval
Approvals are scoped per agent; another agent’s look like they don’t exist.
TEND down or erroring
The call is refused before the tool runs. There is no break-glass path.
An agent calling the tool directly (gateway mode)
The credential lives only with TEND, so the agent has nothing to call with.
Silent edits to the record
The hash chain shows a changed, removed or inserted entry.
Text that displays differently
Control, zero-width and bidi-override characters in an approval are refused.

Agents that skip the checkpoint
In checkpoint mode TEND is cooperative; an agent holding real credentials can act without it.
Whoever controls TEND
Someone who can write to its database can rewrite history; keep the head hash elsewhere.
Processes on the same machine
TEND is not an isolation boundary on your computer.
A fooled or tired approver
An approval is only as good as the text a person read.
Meaning
No prompt-injection detection, content scanning or rules over sequences of calls.
A stolen agent key
It can request approvals and, under an Allow rule, run tools.

In gateway mode, the credential is gone from everywhere the agent can reach, and the target accepts it only from TEND.
You run the TEND server and its database, and trust both.
Operators are trusted: one shared role, no two-person rule yet.
Upstream tools honour idempotency keys, so a retry can’t run twice.
Resources use canonical names; aliases are normalised before asking.