Leash Layer
Revocable ENSv2 authorization and scoped credentials for agent software
Demo
About
Leash is an explainable permission layer for agent software. It identifies an agent wallet through ERC-8004, reads its capabilities from ENSv2 on Ethereum Sepolia, and decides whether a requested action is allowed. When approved, Leash issues a short lived, singleuse credential scoped to one capability and wallet address. Before the protected service executes, authority is checked again against ENSv2, so revoking a role immediately blocks the next request. The project demonstrates how agents can receive bounded permissions instead of permanent API access.
How it's made
Leash is built with Next.js, React, TypeScript, Bun, and viem. The Next.js dashboard and server-side API routes use shared authorization logic from the src backend layer. A custom ENSv2 client reads resource ownership, expiry, and role bitmaps from Ethereum Sepolia. Capabilities are mapped to required roles, and the gate returns structured ALLOW or DENY decisions with stable reason codes, block numbers, and latency. Approved requests receive HMAC-signed credentials containing the agent, wallet, capability, expiry, and nonce. The protected service validates the credential, prevents reuse, and performs a live ENSv2 re- check before execution.