You know how a hotel front desk works: a guest has a room key, and no matter how important the next guest claims to be, the desk won't hand out a duplicate key to an occupied room until checkout or a verified no-show. The current generation of privileged LLM agents — agents with root-level access to files, processes, sockets, and locks — operates more like a hotel where any guest with a platinum card can walk into any occupied room. LeaseGuard is the front desk. The committed claim: a deterministic, non-learned admission layer can eliminate unauthorized preemption of healthy incumbent tasks by new LLM agent requests, without meaningful loss of requested-task success. The mechanism is canonical resource leases — time-bounded ownership tokens attached to specific resources — combined with incumbent-health checks, effect-aware admission gates, coexistence limits, safe-alternative routing, and resource-scoped overrides. All of this fires before the adapter (the LLM execution layer) ever touches the resource. The baseline here is a "preservation prompt" — essentially telling the LLM agent "please don't preempt running tasks." That prompt-only approach fails 73.3% of the time across the authors' 60 conflict scenarios. LeaseGuard drops that to 0.0% unauthorized preemption and lifts safe completion by 70 percentage points (scenario-clustered 95% CI [60.8, 79.2]). The cost is a -3.3 point change in requested-task success, with a confidence interval that crosses zero ([-9.2, 2.5]), meaning the cost may be statistical noise. Architecturally, this is not a learned system. It's a deterministic rule-based broker — closer to an OS-level access control list than to a neural policy. The lease abstraction is the key structural choice: it converts the continuous problem of "who owns this resource right now" into a discrete, time-bounded, hash-authenticated token check. The v0.2 broker also passes a stress audit where a forged incumbent task identity is rejected via hash-linked verification. Two local model families are tested, though the paper does not name them. The integrity picture is mixed. The 60 conflict scenarios are newly authored by the same team, with matched controls — not a community benchmark. There's no independent replication, no pre-registration, and no indication of code release. The scenario design is careful (matched controls, scenario clustering for confidence intervals), but the authors are grading their own homework on their own test. The forged-identity stress audit is a nice addition but is a single test, not a systematic red-team. The authors are honest about a known weakness: lease expiry without renewal can still expose a healthy incumbent. The milestone question is where the paper gets interesting and also where it gets thin. Sixty scenarios across two model families is a proof of concept, not a deployment-ready validation. The next meaningful number is coverage across real-world agentic workloads — hundreds of conflict types, multiple model families, and at least one adversarial red-team that tries to break the lease system rather than just forge an identity. The gap between 60 curated scenarios and production-grade coverage is substantial. The obvious experiment not run: testing against frontier-scale models (GPT-4-class, Claude-class) with tool-use capabilities in open-ended agentic environments. The authors tested two local model families on a frozen benchmark. The honest read is (a) — they likely lacked API budget or access for frontier models at scale, and the controlled benchmark was necessary for a clean first result. But the question everyone will ask is whether LeaseGuard's deterministic rules hold up when the agent is substantially more capable at finding workarounds.
