Egress control
What an agent run may connect to, how Saphan Studio enforces it, and what you still own.
An agent that can only write inside its working directory can still read the machine it runs on and can still connect anywhere. Filesystem confinement does not stop data leaving. Egress control does: a run's outbound connections are judged against a policy, and everything the policy does not name is refused.
The threat
The realistic threat is not a hostile agent. It is an ordinary agent that has been talked into something — by a poisoned dependency, a crafted issue comment, a malicious file in a repository it was asked to review — running on a machine with a working network. Three destinations matter, and all of them are one hop away:
- the cloud metadata endpoint (
169.254.169.254on every major cloud), which hands over the machine's own credentials; - an internal service — a database, an admin panel, a service-mesh neighbour — protected only by being on the private network;
- any host on the internet, which is all exfiltration needs.
Closed by default
A run that says nothing about its network is not an open run. It is judged by its backend's baseline: the hosts the agent needs to reach its own model, plus the package registries shipped for its permission class. Every other destination is refused.
| what you want | what you do |
|---|---|
| the default — the agent reaches its model and its declared toolchain registries, nothing else | nothing |
| your own rule set for a run | author the policy document and dispatch with --egress-policy — see Policies |
| an open network for one run | saphan run … --egress-open "<reason>" — recorded with its reason and actor |
There is no "log and allow" mode and no default-permit tier. If the machine a run is placed on cannot enforce the policy, the run is refused before it starts, at no cost, and the refusal names the fix. The engine never falls back to an open network on its own.
What it covers, and what it does not
- Covered: every outbound connection an agent run opens, on every lane that can carry the wall — see How it works.
- Covered: a hard floor of addresses that no policy can open: cloud metadata, loopback, link-local, multicast and — unless you opt in explicitly — the private ranges — see What no policy can open.
- ⚠ Not covered: it is one layer, owned by this product. Your firewall, security groups and network ACLs remain yours to own; egress control is not a substitute for them.
- ⚠ Not covered: some lanes cannot carry it yet and are refused rather than run open — see Limits and known gaps.
In this section
| page | for |
|---|---|
| How it works | the mechanism on each kind of machine |
| Policies | baselines, workload registries, writing your own document, opening a run |
| What no policy can open | the hard floor and the per-connection checks |
| Preparing a machine | the probe that lets a machine carry the wall, and fixing a host that cannot |
| When something is refused | every refusal, its cause and its remedy |
| The audit record | what is recorded per run and per connection |
| Limits and known gaps | what this control does not do yet |