What this protects you from
An agent that can only write inside its own working directory can still read the machine it runs on, and can still connect anywhere.
An agent that can only write inside its own working directory can still read the machine it runs on, and can still connect anywhere. Filesystem confinement does not prevent data leaving.
The threat is not a hostile agent. It is an ordinary agent that has been talked into something — by a poisoned dependency, a malicious issue comment, a crafted file in a repository it was asked to review — running on a machine with a working network stack. Three destinations matter, and they are all one hop away:
- the cloud metadata endpoint (
169.254.169.254on every major cloud). Reaching it hands over the machine's own credentials, and from there the agent has whatever that machine has. - an internal service — a database, an admin panel, a service mesh neighbour — that is protected only by being on the private network.
- any host on the internet, which is all exfiltration needs.
Egress control removes the road. A connection is admitted only when a named policy admits that host and that port, and refused otherwise. There is no "log and allow" mode and no default-permit tier. The judgement is total: a destination nobody thought about is a destination nobody reaches.
The rest of this chapter
This page states the problem. The control itself is written out over the pages below — start where your question is.
| if you want | read |
|---|---|
| the policy document itself, with two complete examples — one allow, one deny | Writing a policy |
| how a connection is actually judged, and by what | How it works |
| what a policy can never open, however it is written | What no policy can open |
| what a user sees when a connection is refused, and what to do | When a connection is refused |
| what lands in the record afterwards | What lands in the audit record |
| what is built, what is built and unreached, and what is not built | The state of each part |
| the limits and the known gaps | Limits and known gaps |
| a remote agent over SSH: a door on the far host, or a refusal | The remote lane |
⚠ Read the state of each part before you plan around this control. It says, part by part, what runs today — and a plan built on the parts that do not run yet is the one mistake this chapter can still cost you.
⇒ Egress is one of five controls that stand between an agent session and your machine; the whole set is listed here, including what each one does not do.