A proposed open standard

LEASH

Lightweight Encrypted Agent Secret Handling — a proposed open standard for letting AI agents act on your behalf without holding your secrets.

The problem

AI agents are being handed credentials the way interns get handed the master key: fully, indefinitely, and with no record of what they did with it. A leaked agent config today can mean a leaked API key, a leaked password, a leaked life. The industry's current answer — paste your secret into the agent's environment and hope — is not an answer.

The LEASH answer

LEASH makes delegation a handoff, not a secret transfer:

Minimal secret exposure

The agent never sees the underlying credential. It receives a scoped, version-bound delegation that the vault can honor — and revoke, with a stated bound on how quickly the revocation takes effect.

Scoped by default

Delegations name what the agent may do, for how long, and nothing more.

Human sovereignty

The person, not the platform and not the agent, is the root of authority. Every delegation is auditable by default.

Framework-neutral

LEASH is a proposed standard, not a product. It is a security model for agent tool use that depends on no particular framework; MCP is its first binding, and it complements MCP’s own authorization rather than replacing it.

LEASH is a position paper being prepared for the Agentic AI Foundation: we will present it to the foundation’s working groups first, and propose it as a project once an implementation exists.

Read the LEASH position paper on GitHub →

VettID is building one implementation of LEASH. The standard doesn't depend on VettID — that's the point.