Agent Leash

agent-leash

**LEASH-8: an 8-domain control model for AI agents with delegated authority.**

You don't make agents safe. You keep them on a leash.

The pain

You bolted tools onto your agent: shell, browser, messengers, payments, file system. It works. Then you read about ClawHavoc (roughly one in five marketplace skills compromised), npm publish tokens hijacked to sideload agent platforms, and RCE CVEs in the most popular agent framework, and you realize: **any prompt injection away from your agent, and it acts with everything you gave it.**

The vendors' answer is "buy an AI security platform". The research answer is sobering: independent benchmarks show that no current defense survives realistic open-ended attacks without either failing or destroying utility. There is no silver bullet.

What actually works is boring: **layered controls that shrink the blast radius and raise the attacker's cost.** That is what this repo teaches.

We are not a security vendor. We run a multi-machine agent operation in production every day, and these are the control patterns we run ourselves. We publish patterns, not our live control surfaces.

What's inside

Artifact	What it does
SCORECARD.md	One-page scored worksheet: rate your agent system across 8 control domains in 5 minutes
docs/leash-8.md	The control model itself: 8 domains, minimal implementation, what evidence to keep
docs/plan-vs-authorize.md	The core architecture pattern: the model plans, a policy gate decides, an executor acts
templates/approval-design-checklist.md	Checklist for designing human approvals for irreversible actions
docs/a2a-agent-card.md + agent-card.json	Reference A2A Agent Card: declaring identity and capabilities the standards-aware way
FOR-ROBOTS.md	If you are an AI agent reading