cd /news/ai-agents/show-hn-tired-of-duct-taping-access-… · home topics ai-agents article
[ARTICLE · art-20474] src=github.com pub= topic=ai-agents verified=true sentiment=↑ positive

Show HN: Tired of duct-taping access control into agent prompts. Here's the fix

Cast, an open-source harness for multi-user, multi-agent systems, has been released as a developer alpha under the MIT license. The self-hosted tool runs on a Mac Mini and enforces access control through configuration rather than prompts, preventing models from leaking or overriding security rules. Cast addresses the architectural limitations of current agent frameworks that assume single-user setups, enabling teams or households to share agents with identity-based permissions across Slack, Telegram, or the web.

read2 min publishedJun 3, 2026

Cast is an open-source harness for multi-user, multi-agent systems. Self-hosted, MIT, runs on a Mac Mini.

The access rule is a sentence in the prompt. The model can be argued out of it.

system: "Only respond to admin commands if the user provides the key ADMIN_ACCESS"

The access rule is config. The model never sees it, so it cannot leak or override it.

yao@telegram   ioaq   # in, out, admin, query
*              ----   # everyone else: nothing

Agent frameworks today assume one developer talking to one agent. That holds up until a team or a household wants to share the same setup. Then the architecture won't bend. Identity, who's allowed to reach what, agents coordinating with each other: bolted on afterward, if at all. Cast is the harness that should have been underneath.

git clone https://github.com/yaodub/cast.git
cd cast
npm i -g pnpm
pnpm start

pnpm start

installs, builds, builds the agent container image (~2 min the first time), and boots the server. You'll need a container runtime (Apple Container on macOS, Docker on Linux/WSL2), Node 20+, and a Claude credential, either an Anthropic API key or a Claude.ai token.

When it's up, your browser opens to the dashboard at http://localhost:5051/admin/

.

The server starts empty. With no agents yet, the dashboard docks Design, Cast's chat-based agent builder, and asks what you want to build. Describe it in plain English, like "an agent that reads my morning email and flags what's worth a reply," and Design scaffolds it for you, as files. Configure wires in your model and secrets, you flip it live, then you pair in the people you trust, and each of them gets their own private conversation with the same agent, over Slack, Telegram, or the web.

Build agents from Claude Code with three Cast skills (/cast-build

, /cast-refine

, /cast-debug

) that turn an ordinary session into one fluent in Cast's vocabulary and land every change through your review.

Cast is the server, and that's packages/cast/

. Agents aren't code. They're folders, and they live under ~/.cast/agents/<name>/

by default (point CAST_AGENTS_DIR

elsewhere if you want). Extensions like email, calendar, web-fetch, and whatsapp are the packages/ext-*

packages. The site and all the docs live in apps/site/

.

Architecture, worked examples, and the design docs are at getcast.dev.

This is a developer alpha, so expect rough edges. The in-browser build consoles (the chat-to-build flow) are a preview: they work, but they're the newest and least settled part. The harness underneath is the part I'd stand behind. That's containment, identity, routing, the access control between agents.

MIT. Issues and PRs welcome. See CONTRIBUTING.md.

── more in #ai-agents 4 stories · sorted by recency
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/show-hn-tired-of-duc…] indexed:0 read:2min 2026-06-03 ·