Local models are fun until your agent tries to post, open a ticket, or hit an API you did not really want touched. I wanted a blunt “no” between “proposed” and “did it.”

agentctl is a Go CLI with YAML agents/workflows, SQLite-backed runs, and policies that block writes unless you opt in (for example --approve). There are structured logs so you can see exactly what happened.

Quick demo: PR review: fetch, review diff, propose comment, try to post. Posting gets blocked by policy; logs show it.

steps:
  - fetch_pr
  - review_diff
  - post_comment  
# requires approval

Repo: https://github.com/LAA-Software-Engineering/agentic-control-plane