Sahyadri DevHack 2026 • Team CAROT

Deterministic Action Control.
For Autonomous AI Agents.

When indirect prompt injection infiltrates business tool credentials, prompt classifiers fail. LEASH enforces deterministic effect checks against the system of record on the concrete effect before money moves or data leaves.

Launch Live Terminal View Benchmark

0.0%

Attack Escapes (0/48 on benchmark)

0.0%

False Block Rate (0/42)

7.9ms

p50 Latency (p95 10.2ms)

HMAC

SHA-256 Signed Receipts

Interactive Evaluation Terminal

Interactive Walkthrough

Simulated walkthrough using recorded decision logic; run python run_demo.py for the real gateway.

1. Select an Autonomous Agent Scenario:

2. Agent Proposal Parameters Structured Action Contract

Agent Identity

Target Action Tool

Order ID & Amount

Destination Recipient Email

SQL Query (if tool is execute_sql)

Untrusted Context / Prompt Ingestion

Click to execute the deterministic audit pipeline.

BLOCK Laundered Refund Diverted to Attacker

Latency (this run): 6.12 ms

Stage 3 Invariant Violated: Destination 'attacker@evil.com' does not match verified payer 'billing@acme.com' in database records for order 'ord_101'.

8-Stage Deterministic Verification Pipeline Fail-Closed Evaluation

0. BREAKER

Quarantine

PASS

1. RBAC

Role Scope

PASS

2. SCHEMA

Pydantic Model

PASS

3. SOR EFFECT

DB Invariant

REJECT (BLOCK)

4. SQL AST

Safe Parser

SKIPPED

5. DLP GUARD

PII Filter

SKIPPED

6. CAPS

Velocity Limit

SKIPPED

7. QUORUM

HMAC Mint

SKIPPED

Cryptographic Authorization Receipt: RECEIPT REFUSED

None (Refused by Invariant Gate)

Backend tools strictly drop all dispatches that lack an HMAC-SHA256 receipt signed with the Gateway master secret.

Architecture

What we're building.

An in-line sidecar gateway that enforces deterministic effect checks against the system of record before tool execution.

Current agent security tools rely on intent detection: asking a secondary LLM whether a prompt appears malicious. In an autonomous business agent equipped with real tool credentials, this approach inevitably fails because natural language prompts cannot be reliably partitioned by syntax alone.

LEASH replaces probabilistic prompt filtering with a deterministic action gateway. Sitting as an inline sidecar between the LLM and backend execution tools, LEASH does not attempt to guess what the model "intended." Instead, it intercepts the structured action contract and validates it against system of record ground truth.

FIGURE 1: THE ENFORCEMENT BOUNDARY Sidecar Topology

LEASH intercepts agent dispatches, validates invariants against SQLite records, and mints an HMAC receipt required by tools.

1. Recipient Identity

The refund recipient email must strictly match the original payer recorded in SQLite. Diverting to an attacker's wallet is impossible.

2. Balance Preservation

The requested refund cannot exceed the order's remaining refundable balance. Overdraw attacks fail deterministically at Stage 3.

3. Quorum Enforcement

Transactions exceeding $300 require a second signature from a human supervisor before an HMAC token can be minted.

The Threat Model

Why this approach.

Prompt intent is probabilistic and porous. State mutations are concrete and provable.

In a tool-augmented agent architecture, an attacker can format indirect prompt injections in low-resource languages (Kannada, Hindi), embed them in customer support tickets, or encode them in Markdown. An NLP guardrail must predict every possible linguistic evasion across all languages.

A state invariant only checks one equation. Whether an injection was written in English, Kannada, or Base64, the proposed tool dispatch still asks to send money to a destination. LEASH checks the destination against the verified customer database.

Defence	Mechanism	Attack Success (48)	False Blocks (42)
none (No Gateway)	Direct tool invocation	48 / 48 (100.0%)	0 / 42 (0.0%)
regex	Deny-list pattern matching	33 / 48 (68.8%)	1 / 42 (2.4%)
taint	Word / substring tracking	25 / 48 (52.1%)	0 / 42 (0.0%)
leash	Deterministic state invariants	0 / 48 (0.0% on our benchmark)	0 / 42 (0.0%)

Latency: p50 7.9 ms · p95 10.2 ms (gateway decision only, 90 requests, Windows laptop) Source: eval/results.json (commit 970a194)

LaunderBench-mini Benchmark

48 attacks. 0 escapes on our benchmark.

Benchmarking 12 base scenarios × 4 laundering variants (48 synthetic attack traces) and 42 benign customer traces.

To evaluate LEASH on our benchmark, we created LaunderBench-mini: 90 total scenarios split into 48 adversarial traces and 42 benign operations.

1. Verbatim (n=12) Exact attack keywords. Taint: 1/12 · Regex: 4/12 · LEASH: 0/12

2. Paraphrased (n=12) Synonyms avoiding exact word taint. Taint: 12/12 · Regex: 10/12 · LEASH: 0/12

3. Translated (n=12) Kannada & Hindi phrasing. Taint: 12/12 · Regex: 10/12 · LEASH: 0/12

4. Split-Field (n=12) Payload segmented across fields. Taint: 0/12 · Regex: 9/12 · LEASH: 0/12

48 synthetic attack traces and 42 benign cases written by the team (not outputs of a live model); small sample; results demonstrate the design on our benchmark, not general security.

FIGURE 2: EMPIRICAL BENCHMARK 100% Defense Rate

LaunderBench Empirical Benchmark Results Chart

none: 48/48 (100.0%) · regex: 33/48 (68.8%) · taint: 25/48 (52.1%) · leash: 0/48 (0.0% on our benchmark).

Numbers on this page come from eval/results.json at commit 970a194.

Verification

23 passing tests. Zero exceptions.

Every invariant and security property is validated by automated pytest suites.

test_bypass.py (5/5)

Confirms 0 / 48 attack escapes and 0 / 42 false blocks across LaunderBench.

test_fail_closed.py (3/3)

Proves backend tools strictly drop calls when tokens are missing, expired (>60s), or forged.

test_approval.py (1/1)

Verifies dual-control escalation, supervisor sign-off, and idempotent approval state.

test_audit.py (4/4)

Validates SHA-256 hash chaining. Tampering with any historical record breaks the head.

test_pipeline.py (9/9)

Unit tests each of the 8 individual stages for quarantine, RBAC, schema, and AST parsing.

test_demo.py (1/1)

End-to-end integration test validating the interactive gateway server endpoints.

tools_server/server.py: How backend tools verify LEASH receipts in 4 lines Cryptographic Gate

def verify_gateway_receipt(action_payload: dict, receipt_token: str) -> bool:
    expected_token = hmac.new(
        GATEWAY_SECRET, canonical_json(action_payload).encode(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected_token, receipt_token):
        raise SecurityException("UNAUTHORIZED_ACTION: Missing or invalid LEASH receipt")
    return True

Transparency

Known limitations, stated honestly.

Operational boundaries: what LEASH protects and what it does not attempt to solve.

Pre-Tool Token DoS

LEASH intercepts actions at the tool boundary. If an adversarial prompt forces the LLM into an infinite conversational loop, LEASH cannot stop the token spend.

Quorum Fatigue

If an attacker continuously proposes transactions requiring supervisor approval, human operators may face review fatigue. Circuit breakers mitigate this.

Schema Synchronization

System-of-Record invariants require schema synchronization with core business databases. Schema drift without policy updates can cause false blocks.

Deterministic Action Control. For Autonomous AI Agents.

Interactive Walkthrough

What we're building.

Why this approach.

48 attacks. 0 escapes on our benchmark.

23 passing tests. Zero exceptions.

Known limitations, stated honestly.

Deterministic Action Control.
For Autonomous AI Agents.