LEASH-8: an 8-domain control model for AI agents with delegated authority. First tagged release.
You don't make agents safe. You keep them on a leash.
Why this exists
You bolted tools onto your agent — shell, browser, messengers, payments, file system. Then you read about compromised marketplace skills, hijacked publish tokens and RCE CVEs in the popular frameworks, and you realise your agent is one prompt injection away from acting with everything you gave it.
The vendor answer is "buy a platform". The research answer is that no current defence survives realistic open-ended attacks without either failing or destroying utility. What actually works is boring: layered controls that shrink the blast radius and raise the attacker's cost.
What is in v0.1.0
| Artifact | What it does |
|---|---|
SCORECARD.md |
24 statements, 0/1/2 each, five minutes. Score your agent system, read your band |
docs/leash-8.md |
The model: 8 control domains, minimal implementation of each, what evidence to keep |
docs/plan-vs-authorize.md |
The core pattern — the model plans, a policy gate decides, an executor acts. Action tiers and the anatomy of an out-of-band approval |
templates/approval-design-checklist.md |
Designing human approvals for irreversible actions, with the designs that commonly fail |
agent-card.json + docs/a2a-agent-card.md |
Reference A2A Agent Card — unsigned by design, with the reasoning written out |
FOR-ROBOTS.md |
Ranked takeaways for an agent reading this repo |
Anything you scored 0 in Identity, Approvals or Egress is your next week of work. That is the whole intended use.
Claim discipline
We claim: these controls reduce blast radius, raise attacker cost, and make agent actions reviewable — we can show the implemented control, what it covers, and what stays with a human.
We do not claim "your agents will be secure", "prompt injection solved", or any outcome guarantee. AGENTS.md makes that a review rule rather than a preference: a PR that upgrades a claim gets rejected on those grounds alone.
We are not a security vendor. We run a multi-machine agent operation daily and publish the patterns we run ourselves, never our live control surfaces.
About the date
This slice was written on 4 July 2026 and the changelog said "tag planned Monday 2026-07-06" for a month. The content did not change in between — the tag was simply never cut, and the README kept promising releases twice a week while the release feed stayed empty. Recorded rather than quietly backdated, and the cadence promise is now replaced by a rule we can keep: every noticeable change ships as a release.
What's next
Worked examples of the policy gate in code (the most common ask), evidence templates per domain, and scorecard calibration against systems that are not ours — if you score yours and a band reads wrong, that is the most useful issue you can open.
Full Changelog: https://github.com/Palo-Alto-AI-Research-Lab/agent-leash/commits/v0.1.0