RUNTIME ENFORCEMENT

How enforcement works

AgentPaaS enforces policy at the network boundary. Every run gets an isolated agent container and a dedicated gateway sidecar. The agent cannot reach the internet directly. Every outbound request passes the gateway, which allows only declared destinations and injects credentials at request time.

GATEWAY TOPOLOGY

Internal-only agent network

Each run creates two containers on separate networks. The agent is attached only to an internal bridge network with no default route. The dual-homed gateway connects the internal network to a dedicated egress network. Topology isolation is primary; in-container iptables is defense-in-depth.

┌─────────────────────────────────────────────┐
│  Docker Host                                │
│                                             │
│  ┌──────────┐     ┌──────────┐             │
│  │  Agent   │─────│ Gateway  │──── Internet│
│  │ (internal│     │(dual-homed│            │
│  │  network)│     │ net)     │             │
│  └──────────┘     └──────────┘             │
│      │                  │                  │
│  internal net      egress net              │
│  (no internet)     (internet)              │
└─────────────────────────────────────────────┘

HTTP_PROXY and HTTPS_PROXY point the agent at the gateway. HTTP and HTTPS traffic through the proxy is inspected and policy-checked. Raw TCP and UDP are blocked by network isolation, not deep inspection.

POLICY COMPILATION

Policy becomes a deny-by-default boundary

AgentPaaS validates policy.yaml, rejects unknown fields, computes a canonical policy digest, and compiles egress rules into gateway networkAuthorization. Domains that do not match an allow rule are denied by default.

frontendPolicies:
  networkAuthorization:
    rules:
      - allow: dns.domain == "api.weather.gov"

ENFORCEMENT AT RUNTIME

Proxy, evaluate, allow or deny, audit

• 01: Proxy the request to the gateway.
• 02: Evaluate destination domain, method, and port.
• 03: Forward allowed traffic and inject brokered credentials.
• 04: Return 403 Forbidden or a connection error for denied traffic.
• 05: Append every decision to the signed audit chain.

CREDENTIAL INJECTION

The agent never sees the secret

Credentials in policy.yaml are resolved from the macOS keychain. The gateway injects them as headers on approved requests. The agent code never sees the secret value. Direct file leases require an explicit policy declaration.

AUDIT TRAIL

Hash-chained evidence

Egress allows, denials, credential use, and MCP calls append to a hash-chained JSONL audit log. Export the chain and verify it on a second machine.

HONEST LIMITS

HTTP and HTTPS through the proxy is inspected. Raw TCP and UDP are blocked by isolation. Ingress is local-only in the current release. See the known limitations.

What is agent security? · Threat model · Policy reference · Quickstart

Last reviewed August 2026