Have been developing and using a similar thing myself: https://github.com/kamyar/ozm https://github.com/kamyar/ozm - Oberzugriffsmeister (“chief access master”

Have been developing and using a similar thing myself: https://github.com/kamyar/ozm https://github.com/kamyar/ozm - Oberzugriffsmeister (“chief access master”) Still some rough edges, and definitely not security audited. :) In essence: All commands are routed through ozm, which has a per project and global allow list and block list. Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.