TENURE

• 

  Hero_Section

Inspiration

AI agents are starting to do real work inside companies, but access control has not caught up. Most agents either receive broad permissions from the beginning or wait for a person to approve every action. Broad access is risky, while constant approval removes the value of automation.

I built TENURE around a simple idea: an agent should earn access through verified work, and that access should be removed safely when the evidence can no longer be trusted.

What it does

TENURE is an authority system for enterprise AI agents.

The demo follows three agents: Vendor, Invoice, and Treasury. They begin with no permission to perform business actions. After completing verified work, each agent receives a short-lived capability passport containing only the action, identity, amount limit, tenant, and expiry it needs.

Every action is checked before it changes the sandbox. TENURE also creates a signed receipt that records the evidence, policy, permission, and result.

When vendor evidence is compromised, TENURE freezes the affected capabilities before calling Gemini. The Gemini Supervisor Agent then investigates the incident. It checks the dependency graph, ledger, Agent Registry, Memory Bank, traces, reversible actions, and escalation options.

The Supervisor decides how far the demotion should go, requests safe rollbacks, explains what happened, and escalates anything that cannot be reversed. It cannot grant access, create credentials, or change policy. Its proposal must pass deterministic validation before TENURE acts on it.

How I built it

I built the authority system in Python and exposed it through a FastAPI backend. The interface is a responsive control room where a user can run an invoice case, inspect earned permissions, open action receipts, compromise evidence, and follow the recovery process.

The Supervisor Agent uses Gemini 3.5 with Google Agent Development Kit. Its tools are intentionally limited to investigation, rollback requests, and escalation. Deterministic code handles promotion, passport validation, containment, and final policy checks.

The Google Cloud architecture uses Cloud Run, Firestore, Pub/Sub, Vertex AI Agent Engine, Agent Registry, Memory Bank, Model Armor, and Cloud Trace. Separate runtime identities were created for the Supervisor, Vendor, Invoice, and Treasury roles.

I also built a reproducible test set with 500 synthetic cases across 20 control scenarios. It compares TENURE with a broad permanent credential and a workflow where every action waits for human approval.

Challenges I ran into

The hardest decision was choosing where the AI model should have authority.

Letting a model grant permissions would make the system difficult to defend. Removing the model completely would make incident investigation too rigid. I solved this by separating the two responsibilities. Deterministic policy grants authority, while the Supervisor Agent investigates failures and proposes recovery.

Another challenge was proving that the system was enforcing decisions instead of only displaying them. I added signed capability passports, checks at the mutation boundary, tenant isolation, replay protection, action receipts, and a hash-chained ledger.

I also designed the recovery path to fail safely. If Gemini returns an unknown action or proposes something outside policy, TENURE rejects the proposal without executing it.

Accomplishments that I am proud of

TENURE now runs a complete three-agent workflow with earned, limited, and revocable authority.

The recovery flow freezes risk before the model is called, investigates downstream impact, reverses safe sandbox actions, and records an escalation for irreversible results.

The project has 174 passing automated tests. In the included 500-case synthetic control test, TENURE automated all 100 safe opportunities and authorized none of the 400 unsafe opportunities. These results describe this test set, not production performance, and the full methodology is included in the repository.

I am also proud that the product makes its boundaries visible. It clearly separates real Gemini reasoning, deterministic controls, synthetic business actions, cloud evidence, and work that still needs production hardening.

What I learned

I learned that agent identity and agent authority are different. Registering an agent tells us who it is, but it does not prove what that agent should be allowed to do right now.

I also learned that a correct answer is not enough. The evidence, policy, identity, scope, and reasoning behind the answer matter when an agent is earning permission.

The main lesson from TENURE is simple: granting authority should be deterministic because trust must be defensible. Investigating failure should be agentic because incidents require judgment.

What's next for TENURE

The next steps are native Google Agent Gateway enforcement, stronger transaction reconciliation, durable recovery jobs, automatic incident memory with human review, external security testing, and measured model cost and latency.

The long-term goal is to make earned authority a practical security layer for any company running a fleet of AI agents.

Built With

• cloud-run
• firestore
• gemini-3.5
• google-adk
• model-armor
• opentelemetry
• pub/sub
• vertex-ai