Capability Lease, explained for beginners

Capability Lease makes sure that when one AI agent hands work to another, permissions and budget can only shrink.

What it is

A planning agent often hands jobs to worker agents. The worker needs some of the planner's permissions, but never more. A common failure: the hand-off quietly gives the worker something the planner never had, like the ability to send money.

Capability Lease issues the planner a signed lease (permissions, budget, time limit, issued for a named person). When the planner delegates, the child lease is checked: every permission must already be in the parent's lease, and the budget can't exceed what the parent has left. Anything else is refused with an error, and revoking the parent revokes every child.

An everyday comparison

A manager can let an assistant use the company card for office supplies under $50, but can't give them a card with a higher limit than the manager's own.

How it works, in 4 steps

1. A person's agent gets a root lease: permissions, budget, time.
2. It asks to delegate part of that lease to a worker.
3. The child is checked: only permissions the parent has, only budget the parent has left.
4. Escalations are refused; revoking a parent revokes its children.

Try it now

Open the four live demo tools → Every button sends a real request to the live product and shows the real answer.

See it on the homepage: Capability Lease section →

Who it is for

Teams building multi-agent systems where agents spawn or call other agents.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.