Security/Egress control
Limits and known gaps
What egress control does not do in this release, stated plainly so you can plan around it.
Each row says whether the capability exists, whether it is exercised, and what is therefore not proven.
| limit | what it means for you |
|---|---|
| One policy document per installation | There are no per-seat or per-machine policies. A run uses its baseline, the one installation document, or is opened. |
| Your document replaces the baseline | A run dispatched with --egress-policy gets only what your document names — include the model hosts. |
| Few workload registries | Only Go, npm and Maven Central ship. Any other registry — PyPI, private registries — needs your own document or --egress-open. |
| Docker image pulls are not judged | The pull is made by the Docker daemon, outside the run. |
| Remote containers are refused | A container run on a machine reached over ssh cannot be walled in this release and is refused. |
| No per-connection record for remote runs | Remote runs are enforced, but their individual connection decisions are not recorded. |
| No read-back for per-connection records | Local runs record every decision, but this release has no command or page to read them. |
| Opening a run is recorded, not restricted | --egress-open requires a reason and records the actor, but any operator who may dispatch can use it. Review opened runs by their policy source. |
| The console editor is not role-gated | Any signed-in console session can save the installation document. |
| The container bridge is not yet proven end to end | The local container bridge is built and is chosen automatically, but has not been exercised with a full agent turn. Treat it as unproven. |
| Model egress is sealed only in one configuration | Only a baseline-judged run on a Linux network wall, under the legacy harness and the engine's jail, is forced through the guardrail. Elsewhere the agent is pointed at it, not forced. |
| Only TCP on the policy's ports is judged | On the network wall, TCP on the policy's ports goes through the door; other TCP is reset and other UDP rejected. On the container bridge, ICMP and other non-TCP, non-UDP protocols can still reach the host's Docker gateway and peer containers. |
| Some refusals are not recorded | On the network wall, unlisted names fail at resolution and unlisted ports are reset by the kernel; neither leaves a per-connection record. |
| Policy source has no viewer | The run record stores which policy judged a run, but no command or page displays it. |
| It is one layer | It does not replace your firewall, security groups or network ACLs. |
The audit record
What is recorded about a run's network: its policy, the policy's identity, and each connection decision — and how far each can be read back today.
Guardrails
A checkpoint between an agent and its model provider that records every exchange and, when you choose, lets your own rules stop one.