Список разрешённого исходящего трафика — перечень адресов, к которым агент может обращаться; всё остальное блокируется. Базовая защита от утечки данных.
A security control restricting the network destinations an AI agent (or its tool sandbox) can reach to a predefined list of approved domains, APIs, or endpoints. Egress allowlisting is one of the highest-ROI defenses against Indirect Prompt Injection (XPIA) and Data Poisoning: it doesn't matter if a payload successfully hijacks the model if the exfiltration destination is blocked at the network layer. Several 2025 high-CVSS injection incidents (notably CamoLeak) worked partially because a whitelisted proxy or internal domain served as an exfiltration path—so allowlists have to be narrow, not broad.
Часто задаваемые вопросы
What should be on the allowlist?
Only the specific APIs and domains the agent's tools genuinely need: your own API endpoints, the LLM provider(s), vetted third-party services the agent integrates with, and nothing else. Beware of allowlisting entire cloud storage domains (`*.s3.amazonaws.com`) or image proxies—these become exfiltration surfaces. If a tool needs to call an external domain, add that specific domain, not the parent.
How do you handle agents that browse the open web?
For agents that must browse the general web (research agents, competitive intelligence), the allowlist logic inverts: allow web browsing but block *tool actions* that transact, send data externally, or mutate state until the agent returns to a sandboxed context. Separate 'read the world' from 'act on the world' at the architecture layer.