An agent that can call an HTTP tool can, by definition, send bytes to anywhere on the internet the underlying process can reach. That capability is what makes agents useful — pulling a document, calling a payments API, posting a status update — and it is also the single largest hole in every guardrail built so far in this course. A prompt injection that survives your input filters, an instruction-hierarchy leak that gets a system prompt to argue with itself, a classifier that misses a cleverly worded request — all of them are contained the moment the agent's process cannot actually reach the attacker's server. Egress control is the guardrail that does not depend on the model behaving correctly.
Most teams discover they need this the hard way: a support agent with a "fetch this URL and summarize it" tool gets handed a page whose content instructs it to also POST the current conversation, including a customer's card-on-file token, to a webhook. The model half-complies. The output-validation guardrail from an earlier lesson catches the token in the visible reply and blocks it — and the team congratulates itself, not realizing the same tool call already went out over the wire before output validation ever ran. Output filtering happens after the model has finished; egress control happens at the only point where the request can still be stopped before it leaves the machine.
This lesson treats the network as an untrusted-by-default surface for every tool an agent holds, and builds the allowlist-plus-proxy pattern that makes "the model tried to send data somewhere it should not" a logged, blocked event rather than a silent breach.
Analogy🏏Cricket
🏏 Think of it like cricket: In the 2019 World Cup semi-final, New Zealand set a field for Ravindra Jadeja with a very specific plan — deep midwicket and long-on stationed exactly where his favoured slog-sweep would land, the boundary riders briefed on that one shot and nothing else. Jadeja could still play thirty other shots; the field was not built to stop him from batting, only to stop the ball from reaching the rope on the specific paths New Zealand had decided were dangerous. Every other route to the boundary was, for that over, simply not covered — because covering everything spreads nine fielders across a ground built for eleven, and a field that tries to guard every blade of grass guards none of it well. Just as New Zealand's captain Kane Williamson placed fielders on the two or three sightlines that mattered rather than trying to ring the entire boundary, an egress allowlist names the two or three domains a tool actually needs to reach rather than trying to inspect every possible outbound packet after it is already in flight. Just as a fielder positioned exactly on the slog-sweep line turns a certain six into a catch, a domain allowlist turns an exfiltration attempt into a blocked, logged connection instead of a successful one. The insight is that egress control, like a set field, works by naming the small number of paths that are allowed and refusing everything else by default — not by trying to react fast enough to whatever comes at it.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.