Authenticated does not mean appropriate.
A valid token proves who is calling. It does not stop a customer-support bot from calling an internal deletion API.
No SDKs · Out-of-model Security · Zero Telemetry
The model does the thinking.
Tenure does the policing.
Asking models to follow fragile system prompts is a losing battle.
Tenure gives every chat client, IDE, and agent access to institutional knowledge, turns observed agent behavior into policy, enforcing not just what's allowed, but what must be true before it happens.
Agent Intent “Send follow-up offer to Prospect”
Evaluating preconditions…
- Identity — Token authenticated, workload-id 9482 PASS
- Auth — CRM write permission PASS
- Precondition — “not currently a paying user” FAIL Evidence: CRM query returned ‘active’
Decision Block & escalate Policy #104
The problem 01 02 03
Your AI can act. Your infrastructure can't judge when it should.
AI is no longer trapped inside a chat bubble. Whether it's an internal copilot querying databases, a background agent updating a CRM, or a model executing tool calls, downstream business systems only check the API token. They are blind to whether the agent's actual intent is safe, authorized, or completely rogue.
Permission does not equal intent.
An agent may have CRM access without being allowed to update every customer in every situation.
Observability happens too late.
Logs will tell you how you got hacked. Enforcement stops it from happening.
Where Tenure fits
One gateway every agent request passes through.
Tenure provides the right institutional knowledge and evaluates policy before allowing, blocking, or escalating an action in under 15ms.
Chat client
IDE client
Interactive agent
Background agent
Private beta
Tenure
Runtime gateway
Every request gets eligible context. Every consequential action is checked before it executes.
Identity Every agent authenticates before it acts
Permissions & evidence Checked against what the task actually requires
Decision Allow, block, or escalate, logged every time
Models
Tools
APIs
Business Systems
Deterministic Mapping
No "AI magic." Just absolute wire precision.
When security vendors promise automated policy generation,
engineers expect an LLM wrapper that will hallucinate tool names, mangle argument schemas, and force you into endless cycles of manual configuration editing.
RAW WIRE PAYLOAD (Deterministic Input)
{
"type": "tool_call",
"name": "stripe_refund_customer",
"arguments": {
"user_id": "usr_9482",
"amount_cents": 5000
}
}➔
OBSERVED CAPABILITY MATRIX
Capability:
stripe_refund_customer Argument constraint:
user_id (String) Argument constraint:
amount_cents (Integer) If Tenure didn't observe it, it isn't on this list. No freeform entry, no guessing at what your agent might call.
Observation Mode
Two ways to observe
Policy can only contain what Tenure has observed, but observation itself looks different depending on where the agent is.
If an agent is completely unconstrained in production, observation alone will not stop it from causing harm before a policy exists. Tenure therefore supports the same discovery model at two different stages in an agent's lifecycle:
1. In Production: Track the Baseline
Most agents worth worrying about are already live: calling fetch_customer, drafting emails, touching real infrastructure. Tenure observes those workflows as they run and captures what the agent actually does.
2. In Development: GroundEval
If the agent isn't live yet, or you're reshaping its environment, you don't have to guess blind. GroundEval is our free tool for the development stage. Point it at your agent in staging, and its Observe Mode drafts a policy from a real test run.
Shared scoped memory
Shared memory without shared everything.
Tenure preserves your organization’s institutional knowledge across every AI tool, without mixing teams, projects, or users into one shared pool.
ORG Never send customer secrets to third-party tools. Absolute organizational rule
TEAM Platform APIs use structured error envelopes. Shared team practice
PROJECT Payments service migration targets PostgreSQL 18. Project-specific state
USER Prefer concise explanations with code first. Persona lane · not eligible for this token
Token policy agent:code-reviewer
Org contextAllowed
Team: platformAllowed
Project: paymentsAllowed
User personaOff
Eligible context 3 scoped beliefs Only active, relevant context can enter the request.
Memory built for models, not humans
Tenure structures the decisions, practices, relationships, preferences, and corrections that run your org into beliefs the model understands.
Cryptographic Isolation
Every chat client, IDE, and agent is only given access to the knowledge it's allowed to. No worrying about context bleed across projects.
Tamper-Proof Audit Trails
Every belief retains its origin, scope, and lifecycle history. Know why an agent knew something, and when it found out.
Memory precision
The right belief, at the right time. Nothing extra.
Other memory systems drag loosely related memories forward as the conversation changes. Tenure provides the right belief at each turn, so when the topic shifts, irrelevant context stays behind.
89 benchmark cases
<15ms context injection
0.00 drift score
Built to be inspected
Nothing important should be invisible.
See what Tenure knew, what context the model received, and why an agent action was allowed or blocked. Track every change in real time; not after something goes wrong.
TYPE decision SCOPE project:payments
“Payments migration targets PostgreSQL 18.”
TOKEN agent:code-reviewer ELIGIBLE 3 beliefs
Injected project decision + team API practice.
POLICY #104 · v7 EVIDENCE active_account=true
Follow-up offer blocked before CRM action executed.
Get started
Secure and contextualize every AI request at runtime.
Run Tenure Community to give institutional knowledge to your AI tools, or leverage Tenure Team to govern every outbound LLM call across your entire company.