Guided proof
Revoke. Call again. Get denied.
The important Leash demo is not a successful request. It is the next request failing after authority changes.
01
Allow
Run an authorised inference.call from the dashboard.
02
Revoke
Use the protected admin endpoint or revoke the ENSv2 role from your wallet.
03
Deny
Repeat the request and inspect NO_ROLES_ON_RESOURCE in the audit stream.
04
Narrow
Grant a smaller role set and prove only the matching capability succeeds.
Admin safety
Writes are disabled by default
Role-write routes require both LEASH_ADMIN_ENABLED=true and a server-side PRIVATE_KEY. The browser never receives the key.