I built Sandclaw (https://github.com/qix/sandclaw) to test an idea of having a human in the loop on any write path that the agent might do. The core agent has access to read anything, but other than to the LLM provider that information is securely firewalled off.

Over time I can loosen the firewall, and allow safer actions (i.e. adding a task to my todo list is always safe), and perhaps build smarter checks to allow more autonomy. But the `DEFAULT DENY` to sending/deleting emails, browsing untrusted websites, or running shell commands.

Is there any project that actually does this? I've been searching but it looks like all the options focus on letting the agent handle when to ask, which feels... problematic.