Tenure and AgentValet use a lot of the same words: runtime enforcement, scoped agents, audit trails. They are not the same product, and honestly, they are not even direct substitutes. Tenure is a proxy on the model call. AgentValet is a broker on the platform call. This page explains the difference and tells you plainly where each one wins.
Tenure is a self-hosted proxy that sits between your AI client and the LLM provider. You point your API base URL at it, and it does two governance jobs on the way through: it filters which tools the model is shown before inference, and it can withhold a tool call the model returns after inference. It also does something AgentValet does not do at all: it manages governed memory, extracting and merging beliefs with provenance and scope isolation.
What Tenure never does is hold a platform credential. When the model's tool call comes back approved, your agent executes it with keys the agent already has. That is the seam this whole comparison turns on: an agent with its own keys can act without asking, and any code path that does not route through the localhost proxy is invisible to it. Tenure makes exactly this argument against gateway-style competitors, that a gateway only sees traffic you explicitly routed through it. At the execution layer, the same argument applies to Tenure.
Governance ends where the suggestion ends. The keys stay with the agent, so removing the proxy removes the governance and nothing stops working.
The credential lives only in the vault. Remove AgentValet and the agent has nothing to call with. No bypass without the secret.
| AgentValet | Tenure | |
|---|---|---|
| Enforcement point | The platform call. The broker holds the credential and attaches it in memory at call time. | The model call. A local proxy filters tools pre-inference and screens tool calls post-inference. |
| Holds platform credentials | ✓ Yes. Envelope-encrypted in a vault, decrypted in memory per call, never given to the agent. | ✕ No. The agent keeps and uses its own keys. |
| What a bypass looks like | There isn't a quiet one. The agent has no key, so an ungoverned call has nothing to authenticate with. | Any call not routed through the localhost proxy: a direct API call, a second code path, a key already in the environment. |
| Governed memory and context | ✕ Not a feature. AgentValet does not manage what your model remembers or is shown. | ✓ The core product. Belief extraction and merging, provenance, scope isolation. Genuinely good work. |
| Per-agent identity | An RS256 keypair per agent, so every call is attributable. Child agents can be issued their own short-lived identities with scopes cut down to a subset of the parent's. | Scoped agent tokens within the proxy's own model. |
| Human approval on risky actions | ✓ Approval-as-policy: the call pauses at the broker and a human approves out-of-band before it runs. | Policy screening happens in the proxy; the execution step stays with the agent and its keys. |
| Audit trail | Append-only at the database level: the app can add rows, never edit or delete them. Records the execution, not just the suggestion. | Audit trails of model-side traffic that passed through the proxy. |
| Revocation | Revoke an agent and its next call fails closed, everywhere, because the credential was never distributed. Revoking a parent contains its child agents too. | Removing an agent's proxy access does not touch the keys the agent already holds. |
| Deployment | Managed service. The parts that touch your machines (MCP server, CLI, adapters) are MIT open source. | Self-hosted, MIT licensed, Docker on localhost. Local-first by design. |
| Pricing model | Priced on the calls your agents make, not seats. Free tier, paid plans from $19/mo. | Free open-source core, per-user team pricing ($25 per user per month, $99 minimum), enterprise custom. |
If your problem is what your agents remember and what context they are fed, Tenure is built for that and AgentValet is not. Governed memory with provenance, belief merging across sessions, and scope isolation between agents is real, hard work, and there is no AgentValet feature that replaces it. Tenure is also fully self-hosted under MIT, so if a hard requirement is that nothing leaves your machine, their model fits and our managed broker does not. And filtering what the model is shown before inference is a legitimate defence-in-depth layer: fewer visible tools means fewer bad suggestions to catch later.
If your problem is what your agents can actually do, the enforcement has to live where the action happens. AgentValet holds the credential, so scope checks, human approval, and the audit row happen on the real call, and a compromised or misconfigured agent has no key of its own to fall back on. Identity is cryptographic per agent, revocation is immediate because there is nothing distributed to claw back, and the audit log records what was executed, not what was suggested. None of that depends on which model, framework, or gateway you use upstream.
And the two compose. Screen context and suggestions at the model with Tenure if you like the approach; put the keys behind a broker either way. The layers do not conflict, because they never touch the same seam.
The free tier takes one command: npx @agentvalet/register. Run one real agent through it and try to make an ungoverned call. Tenure details on this page were checked against tenureai.dev and the Tenure GitHub README on 20 August 2026; if something has changed, email us and we will correct it.