Keep your agents on a leash.
Give an AI agent its own wallet, then bound it: a per-transfer cap it cannot raise, an allowlist it cannot widen, and one on-chain write that cuts it off everywhere.
Simulated. The real leash lives in the console.
This already went wrong for other people.
In January 2026, ungoverned trading agents at Step Finance moved 27 to 30 million dollars. A prompt injection drained roughly 150 to 200 thousand dollars from Grok and Bankr users after a guardrail was silently rewritten. The lesson is simple.
Instructions don't survive a clever prompt. Contracts do.
So LEASH puts the boundary where prompts can't reach it: enforced on-chain, not by a system prompt the agent can be talked out of.
You watch every move it makes.
This isn't a screenshot. It's the real console chrome, breathing — a fleet card whose tether tautens as spend nears the cap, and a verdict stream adjudicating each transfer in real time. The same approval card reaches you on your phone, through the LEASH Telegram bot.
- The tension meter is the budget — slack when there's room, taut near the cap.
- Every verdict flashes in once, jade for allow, garnet for deny — then rests.
- One cut revokes it on-chain, everywhere a rail resolves the record.
Simulated console. The real one, with your fleet, lives behind sign-in.
Three bounds it cannot loosen. One cut you can make.
The policy lives in a contract on 0G Chain. The contract checks it before every settle. The agent signs — it never sets.
A ceiling it can't raise
Per-transfer, daily and weekly caps are fields in the policy contract on 0G Chain. The contract reads them, compares, and settles only within them.
A reach it can't widen
Funds only move to payees the owner added. The agent has no path to extend its own allowlist.
One write that cuts it off
Revoke is a single on-chain write. Every rail resolving that record stops honoring the agent — at once.
What the leash actually is
Control, not custody. Caps are a soft budget the rail enforces on settle; the allowlist defaults so the agent can't widen its own reach; revoke is on-chain-resolved. It is not a trustless vault — it's a leash you hold and can cut.
Refused. Over the per-transfer cap.
The contract held. You didn't have to be awake.
Revoked in one move.
The record stays: hash-chained, yours alone.
Every move, adjudicated.
Allow or deny, with the reason and the on-chain receipt. This is what the rail writes as your fleet spends.
Stream simulated. The contracts enforcing it are real, on 0G Galileo testnet:AgentRegistry ↗LeashAccountFactory ↗a live revoke ↗— both Sourcify-verified.