Add attenu-guard: in-process permission enforcement across sub-agent handoffs, offline-verifiable audit log

README.md

@@ -175,6 +175,7 @@ Projects that instrument agents for security observability, which could be usefu
 | [SourceryKit](https://github.com/ProvablyAI/sourcerykit) | zero-knowledge, source-of-truth, egress, MCP, allowlist | Source-available Python SDK and gateway that verifies an agent's outbound HTTP requests and MCP tool calls against a source of truth using zero-knowledge proofs, so a call only goes out if its claims check out. Allow-lists trusted endpoints and logs every outbound call for provenance. BSL 1.1, with a hosted backend for the proof and source-of-truth check. |
 | [Prismor Attestation Bundle](https://github.com/PrismorSec/prismor/blob/main/docs/attestation-bundle.md) | attestation, Ed25519, compliance-mapping | Ed25519-signed bundle of governance posture: agent inventory, host discovery (shadow AI sweep), audit-trail anchor, and framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act). JCS-canonical, offline-verifiable. |
 | [aee-conformance](https://github.com/astrogilda/aee-conformance) | in-toto, attestation, recompute-verify | Conformance vector suite and reference verifier for the in-toto Adversarial Execution Evidence (AEE v0.7) predicate. Execute-and-attest model: consumer recomputes outcome from carried bytes rather than trusting producer verdicts. |
+| [attenu-guard](https://github.com/attenu-io/attenu-guard) | delegation, attenuation, hooks, audit-trail, offline-verify | In-process enforcement of per-agent permissions on every tool call and sub-agent handoff: a sub-agent's permission set is computed as a subset of its parent's (chain ceilings, cascade revocation), and every decision lands in a hash-chained, Ed25519-signed audit log that `attenu-guard verify` checks offline from the bundle alone. Zero-dependency Python core; adapters for LangGraph, CrewAI, Google ADK, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, AutoGen, MCP and others. Apache-2.0. |
 
 ## Secrets Management & Isolation
 
@@ -212,6 +213,7 @@ Specs, proposals, reference implementations, extensions, and ideas addressing ag
 - [Verifiable Intent](https://github.com/agent-intent/verifiable-intent) ([blog post](https://shanedeconinck.be/posts/mastercard-verifiable-intent-agents-can-prove-what-you-approved/), [site](https://verifiableintent.dev/))
 - [AI Agent Auth and Authz (IETF)](https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/) (composing WIMSE, OAuth 2.0, Transaction Tokens, and HTTP Message Signatures)
 - [Agent Native Authorization (IETF)](https://datatracker.ietf.org/doc/draft-embesozzi-oauth-agent-native-authorization/) 
+- [Verifiable Attenuated Delegation for AI Agent Chains (IETF draft)](https://datatracker.ietf.org/doc/draft-asor-wimse-agent-delegation-chain/) (JWT/RAR profile: each delegation token commits to its parent; offline verification enforces monotonic attenuation, bounded depth and monotonic expiry; reference implementation in attenu-guard's `wire` module with interop vectors)
 - [CAAM (IETF)](https://datatracker.ietf.org/doc/html/draft-barney-caam-00) (bridges SPIFFE workload identity and IPSIE human identity with ReBAC, RATS attestation, and purpose-bound delegation)
 - [FAPI / RAR (RFC 9396)](https://datatracker.ietf.org/doc/html/rfc9396), [SD-JWT (RFC 9901)](https://datatracker.ietf.org/doc/rfc9901/), [Transaction Tokens](https://datatracker.ietf.org/doc/draft-ietf-oauth-transaction-tokens/) and [agent extension](https://www.ietf.org/archive/id/draft-oauth-transaction-tokens-for-agents-05.html) (implementations: [Tokenetes](https://tokenetes.io/), [kontxt](https://github.com/aramase/kontxt), [keycloak-tts](https://github.com/CarrettiPro/keycloak-tts)), [Identity and Authorization Chaining Across Domains](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/), [Txn-Token Chaining Profile](https://datatracker.ietf.org/doc/draft-fletcher-transaction-token-chaining-profile/), [OAuth Actor Profile](https://datatracker.ietf.org/doc/draft-mcguinness-oauth-actor-profile/), [Attenuating Agent Tokens](https://datatracker.ietf.org/doc/draft-niyikiza-oauth-attenuating-agent-tokens/) (monotonically-attenuating JWT delegation chains with tool-level argument constraints; offline derivation, no issuer contact), [Human Delegation Provenance (HDP)](https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/) (Ed25519-signed append-only hop chain binding human authorization to agent sessions), [DAAP](https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/) (runtime identity for dynamically-spawned agents), [CB4A](https://datatracker.ietf.org/doc/html/draft-hartman-credential-broker-4-agents-00) (credential broker architecture: PDP/CDP separation, SPIFFE identity, DPoP binding, proxy/mint/wrap delivery patterns), [ID-JAG](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/) (Identity Assertion JWT Authorization Grant — agent provider signs assertion for cross-domain identity hop; see [auth.md](https://workos.com/auth-md/docs) for an agent onboarding profile composing ID-JAG with discovery, account linking, client establishment, and delegated access in one click; [analysis](https://notes.karlmcguinness.com/notes/agent-provider-is-the-idp-standards-reading-of-workos-auth-md/)), [CAEP and SSF](https://sgnl.ai/whitepaper/caep-best-practices/), [Deferred Token Response](https://datatracker.ietf.org/doc/draft-gerber-oauth-deferred-token-response/) (async approval-gated token issuance — agent polls while human reviews), [Transaction Authorization Challenge](https://www.ietf.org/archive/id/draft-rosomakho-oauth-txn-challenge-00.html) (agent presents to AS for human/authority approval, receives RAR-scoped token as evidence; agent untrusted to modify challenge), [Condition-Bound Keys](https://datatracker.ietf.org/doc/draft-winmagic-oauth-condition-bound-keys/) (hardware-rooted non-exfiltratable key that exists only while actor + platform + local policy conditions hold), [JWT Authorization Grants in MCP](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/1947), [Token Exchange in MCP](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/214), [AWS Bedrock AgentCore OBO token exchange](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/on-behalf-of-token-exchange.html) (RFC 8693 / RFC 7523 OBO for agents, also [Microsoft EntraID OBO sample](https://github.com/awslabs/agentcore-samples/tree/main/01-tutorials/02-AgentCore-gateway/18-Outbound_Auth_OBO_Microsoft))
 - Workload identity and attestation: [WIMSE](https://datatracker.ietf.org/group/wimse/documents/), [WIMSE for AI Agents](https://datatracker.ietf.org/doc/draft-ni-wimse-ai-agent-identity/), [DNSid](https://datatracker.ietf.org/doc/html/draft-ihsanullah-dnsid-01) (DNS-anchored durable agent identity), [OpenID WISE](https://github.com/identitymonk/openid-wise) (Security Event Tokens for workload identity state changes, building on SSF/CAEP), [Waffles](https://github.com/clawdreyhepburn/waffles-draft), [Trustworthy Workload Identity](https://github.com/confidential-computing/twi), [CoSAI Remote Attestation](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/mcp/model-context-protocol-security.md#324-cryptographic-integrity-and-remote-attestation)