LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents
LeaseGuard is a deterministic admission control layer that prevents privileged LLM agents from displacing healthy incumbent processes.
Researchers present LeaseGuard, a deterministic admission control layer designed to prevent privileged LLM agents from displacing healthy incumbent processes. The system uses resource leases, health checks, and effect-aware admission to ensure incumbent preservation. Evaluation on 60 conflict scenarios shows it eliminates unauthorized preemption and increases safe completion rates.
- LeaseGuard is an admission control layer for privileged LLM agents to prevent unauthorized resource preemption.
- It reduces unauthorized preemption from 73.3% to 0.0% in evaluated conflict scenarios.
- The system uses canonical resource leases and incumbent-health checks for deterministic admission.
Full article182 words · extracted from arxiv.org · click to collapse
Privileged language-model agents can satisfy a new system task by displacing a healthy incumbent that depends on the same file, process, socket, lock, or capacity allocation. This failure arises because execution privilege determines whether an operation can run, not whether the requester may preempt the current resource owner. We present LeaseGuard, a deterministic admission layer that represents preemption authority through canonical resource leases, incumbent-health checks, effect-aware admission, coexistence limits, safe alternatives, and resource-scoped overrides before adapter execution. We evaluate it on a frozen benchmark of 60 newly authored conflict scenarios with matched controls across two local model families. Relative to a preservation prompt, LeaseGuard reduces unauthorized preemption from 73.3% to 0.0% and increases safe completion by 70.0 percentage points (scenario-clustered 95% CI [60.8, 79.2]). Requested-task success changes by -3.3 points (95% CI [-9.2, 2.5]). The fully evaluated v0.2 broker also rejects a forged incumbent task identity in a hash-linked stress audit. Expiry-only reclamation can still expose a healthy incumbent after missed renewal. The evidence supports incumbent-preserving admission when effects are completely mediated, task ownership is authenticated, and lease expiry reflects incumbent liveness.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.24077