Have a look at GitHub.com/Strapchay/protag. I have a similar concept implemented. It’s still a work in progress and I haven’t worked on it for a while but the context is that they can only make modification through a cli tool created for the project which also restricts the context of the files they can look through and each domain agent is assigned specific files and can’t modify beyond it. Still a lot of work to be done though