Your agent asked 'can I run this?' You said yes. It ran it 40 minutes later.

Description and use

Пользователь approбривировал проблему уставленныхApprolightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlightlight

Problem

A human approves an agent's command, then gets pulled away from the approval context. Forty minutes later the agent executes the command in a different directory with code that changed twice since the approval was given.

Outcome

Stale approvals are prevented: a lease expires after its time window, so an approval given at 10:00 cannot execute at 10:40 even if the human is unavailable. The system also enforces a standing deny policy (deny always wins over a valid lease), directory scoping, and command pattern checks, plus tamper detection via the hash-chained ledger.

Workflow

• Grant a command a time-boxed lease with leaseguard grant --for 10m --note "hotfix for #42"

Evidence

I told an agent 'yes, run the deploy' — then got pulled into a meeting. Forty minutes later it ran the deploy. Different directory. Code that had changed twice since I'd looked at it.

Source

the problem isn't that agents are disobedient. It's that our approvals have no expiry date, no scope, and no receipt. A human approval is a moment in time — but we hand it to the agent as if it were a a permanent permission.

Source

leaseguard turns 'yes' into a signed, time-boxed, directory-scoped lease

Source

The gate checks: standing deny policy (deny always wins, even over a valid lease) → lease signature → expiry → directory scope → command pattern. Then it runs the command, passes through the exit code, and appends every decision to a hash-chained ledger.

Source

One file, zero dependencies, Node 18+.

Source

It won't stop a determined adversary with your file permissions, and it says so in the README.

Source