sudo-leash is a time and command gate, not an AI identity boundary. Linux sees Claude Code, Codex, terminals, editors and other desktop programs as the same Unix user. Any process under that user can exercise an active lease.

Allowlist mode renders an ephemeral sudoers rule containing exact command and argument combinations. The helper rejects:

• relative executable paths;
• wildcards;
• commas and backslashes in command specifications;
• executables not owned by root;
• executables writable by group or other users;
• entries without explicit arguments (use "" for no arguments).

Avoid allowlisting interpreters, shells, editors, pagers, package installation from arbitrary local files, or commands that can execute hooks. Those can usually be turned into unrestricted root access.

Full mode writes NOPASSWD: ALL for the configured user until the timer expires or the shield is pressed again. During that window, compromise of any process under the user account is equivalent to root compromise.

The countdown reduces exposure; it does not make full mode safe.

• /usr/local/libexec/sudo-leash-helper is root-owned and performs all rule and state changes.
• /etc/sudo-leash/config and /etc/sudo-leash/allowlist are root-owned.
• /etc/sudoers.d/sudo-leash-control-UID permanently permits only status and disable through the helper.
• /etc/sudoers.d/sudo-leash-runtime permanently includes the root-owned runtime sudoers directory.
• /run/sudo-leash/sudoers/sudo-leash-active-UID exists only while a lease is active and disappears on reboot.
• /run/sudo-leash/state/UID/expires_at stores the current expiry timestamp.

Enabling uses pkexec, so the desktop polkit agent authenticates the human. Disabling does not require authentication.

Each activation creates a transient systemd timer. The timer carries the exact expiry token and will not revoke a newer lease if a stale timer fires. Both the active rule and state live under /run, so rebooting always revokes the lease even if the timer never fires.

Do not publish a working privilege-escalation issue before the maintainer has a reasonable chance to fix it. Open a private GitHub security advisory after the repository is published.