Security Firewall for Agents — Ryan Dahl, Deno
Deno treats production agents as untrusted and filters their outbound traffic outside the agent, showing how broad operational access can coexist with protocol-aware controls.
Deno gives incident agents read and write access to Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack. Its **MIT-licensed Claw Patrol** proxy parses outbound protocols, holds credentials, and applies version-controlled **HCL rules** outside the agent process.
For production agents, put enforcement on the network path rather than inside prompts or agent plugins. Use least-privilege credentials too, but add protocol-aware deny rules, tested fixtures, credential injection, and approval routes for actions that need judgment.
Deno gives incident agents read and write access to Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack. Its **MIT-licensed Claw Patrol** proxy parses outbound protocols, holds credentials, and applies version-controlled **HCL rules** outside the agent process. For production agents, put enforcement on the network path rather than inside prompts or agent plugins. Use least-privilege credentials too, but add protocol-aware deny rules, tested fixtures, credential injection, and approval routes for actions that need judgment. The proxy becomes a highly privileged system because it holds production credentials and must be secured accordingly. Its ruleset is substantial, unsupported protocols need plugins, and the claim that agents resolve many incidents is not quantified here.
This adds a protocol-aware enforcement layer between production agents and external systems, beyond prompt rules, plugins, or execution isolation. It confirms least privilege as necessary but insufficient: credentials, deny rules, fixtures, and approvals must be controlled outside the agent. It also concentrates risk in the proxy that holds those credentials.