Bobby Hall JrBobby Hall JrSoftware engineer
All tiny agents
Secrets & egress

Egress Policy

Denylist vs allowlist vs default deny against one scripted escape.

What it does

A default-deny egress policy for an agent sandbox. It runs three egress policies against one scripted agent escape and counts the off-task requests that got out. The fetch tool and hosts are mocks.

The guardrail

Default-deny network egress.

egresssandboxdefault deny

Run it

git clone https://github.com/bobbyhalljr/tiny-egress-policy.git && cd tiny-egress-policy
npm install
npx tsx egress.ts
Repo
tiny-egress-policy
Language
TypeScript
Stars
0
Price
Free
View on GitHubRead the Dev.to post

More in Secrets & egress

Credential GatewayThe sandbox holds only a short-lived token. The real credential is injected outside.MCP Issuer PinAn MCP client that pins the OAuth issuer before it fetches anything.RAG Revocation GateCached retrieval results are references, not authorization.