I m Sean, the builder behind NextEleven and DeadBolt. I d like to hear from developers about the hardest part of adding execution controls to an agent they already use.

DeadBolt puts a permission check at the tool boundary. A trusted executor checks the gate and starts the protected action only after a fresh explicit allow. You can build it in with Rust, or bolt it on through a local HTTP sidecar or trusted stdio MCP proxy. It is free and open source under Apache-2.0.

The boundary matters: it protects the routes you connect to it. It is not a whole-agent sandbox and cannot cancel an action already running.

The first evaluation uses harmless temporary files and needs no AI account. The captioned walkthrough shows it inside Harness.