Leash

About the Project

I came across the story of a developer who left an AI agent to finish a task with a $100 budget. When he came back, it had spent about $5,000, and its logs said nothing had gone wrong.

Three things failed there. The budget was only a request the agent was trusted to follow, the agent held the real API key so nothing outside it could stop the spending, and the agent wrote its own logs. I was learning about hashing, HMAC, signatures and AES encryption at the time, and Leash came from one question: what if the agent never held the key at all, and those tools enforced its budget and kept a record it couldn't touch?

What It Does

Leash works like a prepaid card for AI agents. It sits between an agent and the AI provider, and each agent gets a pass instead of the key:

• the budget is enforced, not requested — the pass is signed with HMAC-SHA256 and carries its budget, and Leash refuses any call that could go over it;
• the key is out of reach — it's encrypted with AES-256-GCM and only decrypted inside Leash for the moment of each approved call; and
• the record is Leash's, not the agent's — every call is sealed to the entry before it, so changing one entry makes Leash point to it.

Every action passes seven checks before the real key is used, including trap keys: fake keys planted where only a hijacked agent would find them. It works like the OpenAI API, so an existing agent switches over by changing two lines.

The Demos

In the first demo, a real agent with a budget of a tenth of a cent is told to keep improving its work. Leash refuses the step that would take it over budget, shows the agent's own report next to Leash's record, and catches the entry when you try to fake the record.

The second demo plays out Maya's weekend: her shop's AI assistant falls for a malicious email and hits a trap key, gets stuck in an auto-reply loop until its pass runs out, and then someone edits the record to cover it up, and Leash names the exact entry that was changed.