Prerequisites

What a Lease Is

A lease is a grant of permission that is valid only for a bounded period. Unlike a lock, it does not require the holder to release it. If the holder disappears, the grant lapses on its own.

Lease Versus Lock

The Problem Leases Solve

A plain lock assumes the holder will eventually release it. In a distributed system, holders crash, get partitioned, and pause. None of those states produce a release.

Two Clocks, Asymmetric Risk

Every lease involves two independent measurements of elapsed time: the grantor deciding when to reclaim, and the holder deciding when to stop. Disagreement between them determines safety.

Monotonic Time Is Mandatory

Wall-clock time can move backwards during synchronization, which makes a lease appear to have more remaining validity than it does. Monotonic clocks never regress.

class Lease {
    constructor(durationMs, safetyMarginMs) {
        this.durationMs = durationMs;
        this.safetyMarginMs = safetyMarginMs;
        this.acquiredAt = null;
        this.token = null;
    }

    grant(token) {
        this.acquiredAt = performance.now();
        this.token = token;
    }

    remainingMs() {
        if (this.acquiredAt === null) return 0;

        const elapsed = performance.now() - this.acquiredAt;
        return Math.max(0, this.durationMs - elapsed);
    }

    isSafelyHeld() {
        return this.remainingMs() > this.safetyMarginMs;
    }

    assertHeld() {
        if (!this.isSafelyHeld()) {
            throw new LeaseExpiredError({
                remainingMs: this.remainingMs(),
                requiredMarginMs: this.safetyMarginMs
            });
        }
    }
}

Renewal Strategy

A holder that needs continued permission renews before expiry. How early it renews determines how many consecutive failures it can absorb.

class LeaseHolder {
    constructor(grantor, config) {
        this.grantor = grantor;
        this.resource = config.resource;
        this.holderId = config.holderId;
        this.lease = new Lease(config.leaseMs, config.marginMs);
        this.renewIntervalMs = config.leaseMs / 3;
        this.consecutiveFailures = 0;
    }

    async acquire() {
        const result = await this.grantor.grant({
            resource: this.resource,
            holder: this.holderId,
            durationMs: this.lease.durationMs
        });

        if (!result.granted) return { acquired: false };

        this.lease.grant(result.token);
        this.scheduleRenewal();

        return { acquired: true, token: result.token };
    }

    scheduleRenewal() {
        this.timer = setInterval(async () => {
            try {
                const result = await this.grantor.renew({
                    resource: this.resource,
                    holder: this.holderId,
                    token: this.lease.token,
                    durationMs: this.lease.durationMs
                });

                if (!result.renewed) {
                    return this.surrender(result.reason);
                }

                this.lease.grant(result.token);
                this.consecutiveFailures = 0;
            } catch (error) {
                this.consecutiveFailures += 1;

                if (!this.lease.isSafelyHeld()) {
                    this.surrender("margin exhausted during renewal failures");
                }
            }
        }, this.renewIntervalMs);
    }

    surrender(reason) {
        clearInterval(this.timer);
        this.lease.acquiredAt = null;
        this.onLeaseLost(reason);
    }
}

Choosing the Duration

Leases Alone Are Not Sufficient

A lease bounds how long a holder should believe it holds permission. It cannot prevent a holder from acting after expiry, because the holder may be paused and unaware.

-- Grantor issues a monotonic token with each grant
UPDATE lease_registry
SET holder_id  = :holder_id,
    token      = token + 1,
    granted_at = CURRENT_TIMESTAMP,
    expires_at = CURRENT_TIMESTAMP + (:duration_ms * INTERVAL '1 millisecond')
WHERE resource = :resource
  AND (expires_at < CURRENT_TIMESTAMP OR holder_id = :holder_id)
RETURNING token, expires_at;

-- Resource validates the token before accepting work
UPDATE protected_state
SET payload     = :payload,
    last_token  = :incoming_token
WHERE resource   = :resource
  AND last_token <= :incoming_token;

Revocation

Sometimes a grant must end before its natural expiry. Because the holder may be unreachable, revocation has the same fundamental limitation as everything else.

Leases Beyond Leadership

Leadership is the most discussed application, but the pattern appears throughout distributed systems wherever a grant must survive holder failure.

Read Leases

A particularly useful application lets a leader serve linearizable reads without a round trip. Holding a read lease means no other node can have become leader within the lease window.

async function leasedRead(leader, key) {
    if (!leader.readLease.isSafelyHeld()) {
        const confirmed = await leader.confirmLeadershipViaQuorum();

        if (!confirmed) {
            return { ok: false, redirect: leader.knownLeaderId };
        }

        leader.readLease.grant(confirmed.token);
    }

    return {
        ok: true,
        value: leader.stateMachine.get(key),
        servedFrom: "lease"
    };
}

Work Claims

-- Claim an item with a processing lease
UPDATE work_queue
SET claimed_by = :worker_id,
    claim_token = claim_token + 1,
    claim_expires_at = CURRENT_TIMESTAMP + INTERVAL '60 seconds'
WHERE item_id = (
    SELECT item_id
    FROM work_queue
    WHERE status = 'pending'
      AND (claim_expires_at IS NULL
           OR claim_expires_at < CURRENT_TIMESTAMP)
    ORDER BY created_at
    LIMIT 1
    FOR UPDATE SKIP LOCKED
)
RETURNING item_id, claim_token;

Where the Grantor Lives

Failure Modes

Monitoring

Verification

describe("lease safety", function () {
    it("surrenders when renewal cannot reach the grantor", async function () {
        const holder = await acquireLease("resource-a");

        await faultInjector.blockGrantor(holder.id);
        await sleep(leaseMs);

        expect(holder.lease.isSafelyHeld()).toBe(false);
        expect(holder.surrendered).toBe(true);
    });

    it("does not grant twice within one lease period", async function () {
        const first = await acquireLease("resource-a");
        const second = await tryAcquireLease("resource-a", "other-node");

        expect(second.acquired).toBe(false);
        expect(first.lease.isSafelyHeld()).toBe(true);
    });

    it("rejects work from a holder that paused past expiry", async function () {
        const holder = await acquireLease("resource-a");
        const oldToken = holder.lease.token;

        await faultInjector.pauseProcess(holder.id, leaseMs * 2);
        const replacement = await acquireLease("resource-a", "other-node");

        const staleWrite = await resource.write("value", oldToken);

        expect(staleWrite.accepted).toBe(false);
        expect(replacement.lease.token).toBeGreaterThan(oldToken);
    });
});

Common Design Mistakes

System Design Interview Discussion

Design Checklist

Knowledge Check

Summary

A lease is a time-bounded grant. Its defining property is that reclaim requires no cooperation from the holder, which solves the problem locks cannot: a crashed or partitioned holder blocking progress indefinitely.

This convenience comes from trading a dependency on holder liveness for a dependency on clocks. Two independent measurements are involved, and their errors are asymmetric: the holder stopping early and the grantor reclaiming late both cost only availability, while the reverse costs correctness.

Safe implementation requires monotonic time, a margin before acting, and renewal at a fraction of the lease so transient failures are absorbed. Duration balances fast reclaim against thrashing, and must exceed observed pause and latency percentiles.

Critically, a lease is a liveness optimization rather than a safety mechanism. Process pauses are unbounded, so overlap cannot be eliminated by timing alone. Pairing leases with fencing tokens validated at the resource is what makes the overlap harmless, and the pattern extends well beyond leadership to read leases, work claims, shard ownership, and service registration.