LeaseGuard: privileged agents evict healthy processes because privilege answers the wrong question

arXiv 2609.24077·medium signalXBlueskyLinkedInCopy link

A privileged agent asked to do a new system task will take a file, process, socket, lock or capacity allocation away from a healthy incumbent that depends on it, because execution privilege decides whether an operation can run, not whether the requester may preempt the current owner. LeaseGuard is a deterministic admission layer sitting before adapter execution that models preemption authority as canonical resource leases with incumbent-health checks, effect-aware admission, coexistence limits, safe alternatives and resource-scoped overrides. On 60 newly authored conflict scenarios with matched controls across two local model families, unauthorized preemption fell from 73.3% to 0.0% and safe completion rose 70.0 points, at a requested-task success cost of -3.3 points (CI [-9.2, 2.5]). The authors flag the remaining hole themselves: expiry-only reclamation can still expose a healthy incumbent after a missed renewal.