m-network-egress-isolation · MITIGATION
Network egress isolation — deny-by-default agent→internet, enforced at the network layer
Content-layer inspection reads outbound payloads and decides pass, redact, or quarantine per channel — but it can only classify what it can parse as content. A direct TCP/UDP socket opened by agent-executed code, a raw DNS query, or a payload encoded into DNS subdomain labels never reaches an HTTP-shaped inspection point at all. Network egress isolation closes that gap one layer down: every agent and tool-bus process sits behind a default-deny network policy, and the only path to the internet is through an enforced proxy that mediates, allowlists, and logs each connection attempt regardless of what it contains.
At a glance
What it is
Output egress DLP inspects content: it classifies what's inside a response body, a tool-call parameter, or a log record, and decides whether it may leave. That inspection only works on channels the DLP engine can parse as content. An agent with a code-execution or shell tool can be manipulated into opening a socket directly, issuing a DNS query with data encoded in the query name, or splitting a payload across many small requests to a domain it controls — none of which look like the outbound response or tool-call envelope a content classifier is watching. Network egress isolation is the layer beneath content inspection: instead of asking "is this payload sensitive," it asks "is this destination, protocol, and connection pattern permitted at all," and it asks that question for every packet leaving the host, not just the ones that pass through a recognised application channel.
The mechanism is a default-deny network policy applied to the agent's or tool-bus's runtime environment, with a single permitted egress path: an enforced proxy that mediates every outbound connection against an explicit destination allowlist. DNS resolution is routed through the same enforcement point rather than left to the host resolver, so a query encoding exfiltrated data into a subdomain label is denied (or at minimum logged and rate-limited) the same as a direct socket to an unlisted IP would be. Because the policy operates on network primitives — destination, port, protocol — rather than on parsed content, it doesn't need to recognise what a payload contains to block it; an unauthorised destination is denied regardless of what's inside the connection.
This is the second of two layers, not a replacement for content inspection: output egress DLP still catches a credential or PII pattern riding a legitimate, allowlisted channel — a documented API call to an approved destination that happens to carry a secret it shouldn't. Network egress isolation catches the channel DLP never sees: a direct socket, a raw DNS query, or a subdomain-encoded exfiltration attempt that bypasses the inspection point entirely because it was never shaped like an inspectable request in the first place. gVisor narrows what a sandboxed process can reach on the host kernel, but sandboxing alone doesn't restrict where the sandboxed process's network traffic is allowed to go — that's the boundary this control adds.
Detection signals
- Denied-egress attempts per agent or tool-bus identity, broken out by destination class (raw IP, non-allowlisted domain, unexpected port). A sustained non-zero rate on one identity indicates either a prompt-injected exfiltration attempt or an allowlist that hasn't caught up with a legitimate new dependency.
- DNS query volume and label entropy per agent identity. A spike in NXDOMAIN responses or high-entropy subdomain labels is the signature of DNS-tunnelled exfiltration attempting to move data through a channel the content-inspection layer never parses as an egress event.
Threats this addresses
Auto-generated from the coverage map in this mitigation's frontmatter. Each entry links to its threat detail page; the severity-reduction step and notes reflect what this control contributes to containing the threat.
WHY IT HELPS Tool Misuse includes an agent chaining or parameter-polluting a call to move data outward. Output egress DLP catches this when the exfiltration rides an inspectable channel — an HTTP body, a tool-call parameter. A manipulated agent with any execution surface can instead open a raw socket or issue a DNS query directly, bypassing content inspection entirely. Deny-by-default network policy blocks that connection at the network layer before it leaves the host, independent of whether the payload was ever classified.
WHY IT HELPS RCE and Code Attacks give an attacker a foothold that can reach for the network directly — gVisor's syscall interception narrows what that foothold can do to the host kernel, but a sandboxed process can still open a socket to the internet unless the network path itself is also gated. Enforced egress isolation is the complementary control: even fully arbitrary code inside the sandbox has no route to an unauthorised destination.
WHY IT HELPS RAG Data Exfiltration is the leakage of a sensitive corpus through the agent's output channel. If the exfiltration attempt is shaped to evade content classification — chunked across many small requests, base32/hex-encoded into a hostname, or sent as a raw connection rather than a documented API call — the destination itself is still gated. A proxy that only permits connections to an explicit destination allowlist denies the transfer regardless of how the payload was encoded.
WHY IT HELPS Data Residency violations occur when a call crosses a jurisdictional boundary the data isn't authorised to cross. Content classification can miss a residency violation if the regulated field isn't recognised as such; a proxy with a jurisdiction-scoped destination allowlist blocks the cross-border connection at the network layer independent of what the payload classifier decided.
WHY IT HELPS Deny-by-default egress via an enforced proxy stops the browser tool from carrying data to arbitrary origins even when an untrusted page steers it: the network layer blocks the exfiltration leg the Same-Origin Policy cannot, regardless of what the agent is convinced to do.