DeadBolt
A free, open-source execution gate released by Next.11. Before a protected action by an AI agent takes effect, a trusted scheduler makes a deterministic ruling. It supports leases, policies, approvals and revocation.
Timeline (last 90 days)
Next.11 introduced DeadBolt, a free, open-source execution gate for deterministic adjudication by a trusted scheduler before an AI Agent's protected action executes.
DeadBolt is not an operating system sandbox, nor can it shut down frontier models; it denies subsequent protected admission, and cannot cancel a tool function body that is already running.
The released version 1.0.3 of DeadBolt supports the mature lease gate, a native CLI, sidecar, and MCP proxy.
The DeadBolt candidate examples add callback helpers, an installable pipeline, a Python client, optional SDK adapters, scoped credentials, and exact action approval, none of which have yet entered the released archive package.
As of the review of this article, there is no available DeadBolt package published on crates.io or PyPI.
DeadBolt's 11 quick assessment checks pass on both the released archive and the candidate binary, but these checks verify the scheduler and do not constitute proof of isolation capability for any Agent.
When integrating DeadBolt in Rust, the crate package name is n11-deadbolt and the library name is deadbolt.
DeadBolt's lease belongs to the agent identity rather than a vendor API key, the default lease lifetime is 60 seconds, a real-time admission refreshes the sliding lease, and silence lets the lease expire, after which it does not slide.
DeadBolt provides three operator control methods: Pause, Clip, and Kill: Pause temporarily blocks all protected admissions of a given agent, Clip blocks a specific tool of that agent, and Kill revokes that agent and its registered descendants.
DeadBolt control issued after an action has already been admitted cannot revoke that action.
3 more timeline events
All Facts (13)
DeadBolt policy restricts three aspects: the tool names available to the agent, the declarable target tokens it can reach, and the reported spend.
50%UnverifiedDeadBolt is not an operating system sandbox, nor can it shut down frontier models; it denies subsequent protected admission, and cannot cancel a tool function body that is already running.
50%UnverifiedDeadBolt's Python SDK adapter acceptance covers 19 test cases, using a real runner and sidecar, and does not make provider requests.
50%UnverifiedChild processes of the DeadBolt sidecar do not inherit any DeadBolt bearer token.
50%UnverifiedThe DeadBolt candidate examples add callback helpers, an installable pipeline, a Python client, optional SDK adapters, scoped credentials, and exact action approval, none of which have yet entered the released archive package.
50%UnverifiedAs of the review of this article, there is no available DeadBolt package published on crates.io or PyPI.
50%UnverifiedDeadBolt's 11 quick assessment checks pass on both the released archive and the candidate binary, but these checks verify the scheduler and do not constitute proof of isolation capability for any Agent.
50%UnverifiedWhen integrating DeadBolt in Rust, the crate package name is n11-deadbolt and the library name is deadbolt.
50%UnverifiedDeadBolt's lease belongs to the agent identity rather than a vendor API key, the default lease lifetime is 60 seconds, a real-time admission refreshes the sliding lease, and silence lets the lease expire, after which it does not slide.
50%UnverifiedDeadBolt provides three operator control methods: Pause, Clip, and Kill: Pause temporarily blocks all protected admissions of a given agent, Clip blocks a specific tool of that agent, and Kill revokes that agent and its registered descendants.
50%UnverifiedDeadBolt control issued after an action has already been admitted cannot revoke that action.
50%UnverifiedThe released version 1.0.3 of DeadBolt supports the mature lease gate, a native CLI, sidecar, and MCP proxy.
50%UnverifiedNext.11 introduced DeadBolt, a free, open-source execution gate for deterministic adjudication by a trusted scheduler before an AI Agent's protected action executes.
50%