Locally deployed agents have unrestricted access to host filesystems by default, with no granular permission scoping, user consent prompts, or privacy boundaries. Sensitive personal data — health records, financial documents, private media — is silently accessible without disclosure to the user. No standard permission framework analogous to mobile OS sandboxing exists for agent runtime environments.

Local AI agents silently access your entire filesystem — health records, finances, private photos — with zero consent prompts or sandboxing, creating massive privacy and liability risk.

Developers shipping local-first AI agents (coding assistants, personal AI, desktop automation) who need to earn user trust and avoid liability from unrestricted data access.

Mobile app stores proved permission frameworks unlock market adoption — enterprises and privacy-conscious users won't deploy local agents without sandboxing, and agent developers need a standard to ship against rather than building bespoke permission UIs.

Open-source SDK/daemon that intercepts filesystem and API calls from agent runtimes via FUSE or eBPF, presents consent prompts with human-readable scope descriptions, and enforces deny-by-default policies; MVP targets Claude Code, Open Interpreter, and similar CLI agents on macOS/Linux.

Every locally-deployed AI agent needs this — adjacent to the endpoint security market ($20B+) but specifically the emerging agent runtime layer serving millions of developers adopting coding/personal agents.