A faithful replay of Legant's Leash demo: Alice gives her AI assistant spending power for one hour with hard limits enforced offline at each merchant; a prompt injection is declined; and when she revokes, even the token the agent already holds is refused at the merchant via a signed revocation feed.

Legant Live demo · Leash

Give your AI your accounts for one hour, then yank it

Alice leashes her assistant: ≤ $400, travel / rideshare only. The limits are signed constraints enforced offline at each merchant — a prompt injection physically can’t overspend. Then she revokes, and even the token the agent already holds dies at the merchant, because each merchant polls Legant’s signed /.well-known/revoked feed. Faithful replay of go run ./examples/leash.

delegationuser:alice → agent:assistantone hour
limitsmax_amount ≤ $400travelrideshare
rideshare
category: rideshare
hotels
category: travel
giftcards
category: giftcard
spend decisions · offline at the merchantbooting…
the leasharmed
kill-switch
ARMED — assistant can spend within the leash
Tier A · at the mint — once revoked, Legant refuses to issue any new token.
Tier B · at the merchant — tokens already held are refused offline, because the merchant polls the signed /.well-known/revoked feed (no callback to Legant).
why injection can’t win

The cap is a signed constraint, not a prompt rule — there’s no instruction to override.

charged — within the leash declined / revoked — offline at the merchant