Guard Team

One policy for every machine, every machine's receipts in one log, and a message when a server you guard widens what it can do — all kept in storage you control. Leash never receives what your agents did.

How it works

1. Write the two files. npx @leashkit/guard team init writes a starter policy.json and team.json. The policy starts as Guard's own defaults, so nothing changes until you edit it. The team file says where the policy is, where receipts go and which webhook takes alerts.
2. Put them where your team can reach them. Any S3-compatible bucket, or any HTTPS address that accepts GET and PUT.
3. Each engineer joins once. npx @leashkit/guard team join https://…/team.json. Guard fetches the policy, keeps a copy, and re-reads it every ten minutes while a guarded server is running.
4. Every decision is written to your storage. Each machine writes its receipts as small files under its own name. Download them and run leash-guard team verify <folder>: an edited receipt or a missing file fails the check.
5. Run alerts on a schedule. leash-guard team alerts posts to your webhook when the index records a change to a server you guard. Once a day from one machine is enough.

The two files

The team file. The licence line is filled in for you after checkout.

{
  "licence": "…",
  "policy": "https://files.example.com/leash/policy.json",
  "receipts": "https://files.example.com/leash/receipts/",
  "alerts": "https://hooks.example.com/your-webhook"
}

The policy file. default applies to every guarded server; an entry under servers replaces it for that one. The fields are the same ones a local Guard policy takes.

{
  "default": { "caps": { "write": 50, "send": 10, "delete": 5, "pay": 3 }, "approve": ["delete", "pay"] },
  "servers": {
    "payments": { "caps": { "pay": 1 }, "approve": ["pay", "send"], "tools": { "issue_refund": { "block": true } } }
  }
}

For a bucket, use s3://bucket/path for the two locations and add "s3": {"endpoint": "https://…", "region": "…"}. Keys are read from AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY on each machine and are never written to a file. For an HTTPS address that needs a header, set LEASH_TEAM_HEADERS on each machine, for example {"authorization":"Bearer ${env:TEAM_TOKEN}"}.

Manage your subscription

Manage or cancel your subscription. Enter the email you paid with and Stripe sends you a link. From there you can change the card, download invoices and cancel. A cancelled subscription runs to the end of the period already paid for.

The licence is sent only to the address the subscription was bought with, and only if one is active. We do not keep the address you type.

What reaches Leash, and what does not

• Never sent here: your policy, your receipts, your alerts, the names of the servers you guard, or anything an agent did. Those go only to the addresses in your team file.
• Sent here: one request when a machine's licence is within ten days of ending, carrying the licence token and nothing else. The answer is the next token, for as long as the subscription is paid. Nothing about the request is stored.
• If you ask for a lost licence, the email address you type is checked against Stripe and used to send that one message. It is not stored.
• If the subscription ends, machines stop fetching the shared policy and stop writing receipts to your storage, and say so. The limits they last fetched stay in force, and free Guard keeps working: a lapsed payment never loosens a limit.

Good to know