diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Revision history for pms-application-service
 
+## 0.1.1.0 -- 2026-05-02
+
+* Add agentAllowedCmds config to restrict agent-proc-run commands.
+
 ## 0.1.0.0 -- 2026-04-30
 
 * Support timeout configuration.
diff --git a/pms-application-service.cabal b/pms-application-service.cabal
--- a/pms-application-service.cabal
+++ b/pms-application-service.cabal
@@ -20,7 +20,7 @@
 -- PVP summary:     +-+------- breaking API changes
 --                  | | +----- non-breaking API additions
 --                  | | | +--- code changes with no API change
-version:            0.1.0.0
+version:            0.1.1.0
 
 -- A short (one-line) description of the package.
 synopsis:           pms-application-service
diff --git a/src/PMS/Application/Service/App/Control.hs b/src/PMS/Application/Service/App/Control.hs
--- a/src/PMS/Application/Service/App/Control.hs
+++ b/src/PMS/Application/Service/App/Control.hs
@@ -65,6 +65,7 @@
              , DM._promptsDomainData      = conf^.promptsConfigData
               , DM._invalidCharsDomainData = conf^.invalidCharsConfigData
               , DM._invalidCmdsDomainData  = conf^.invalidCmdsConfigData
+              , DM._allowedAgentCmdsDomainData = conf^.agentAllowedCmdsConfigData
               , DM._timeoutMicrosecDomainData = conf^.timeoutMicrosecConfigData
               }
 
diff --git a/src/PMS/Application/Service/DM/Type.hs b/src/PMS/Application/Service/DM/Type.hs
--- a/src/PMS/Application/Service/DM/Type.hs
+++ b/src/PMS/Application/Service/DM/Type.hs
@@ -49,6 +49,7 @@
   , _promptsConfigData :: [String]
   , _invalidCharsConfigData :: [String]
   , _invalidCmdsConfigData :: [String]
+  , _agentAllowedCmdsConfigData :: [String]
   , _timeoutMicrosecConfigData :: Int
   } deriving (Show, Read, Eq)
 
@@ -93,6 +94,7 @@
         , "rm", "mv", "dd", "chmod", "chown"
         , "reboot", "kill", "nc", "sudo", "su"
         ]
+      , _agentAllowedCmdsConfigData = def   -- deny all by default
       , _timeoutMicrosecConfigData = 30 * 1000 * 1000
       }