An agent locking a resource in a device in response to receiving an explicit request to lock the resource. Once in a locked state, access to entities (applications, devices, etc.) other than a owner of the lock may be restricted (e.g., no access, only read access, etc.). The agent unlocks the resource in response to an unlock request or if keep-alive messages are not received for a long duration.