Capability
AI agent firewall
An agent firewall sits between an agent and the systems it acts on, and decides per action whether that action proceeds. The name borrows from network firewalls and the analogy is misleading in one important way: a network firewall decides about traffic, which is cheap to classify. An agent firewall decides about intent, which is not.
What it actually decides about
The useful dimensions are not the ones a network firewall uses. Source and destination barely matter; what matters is what is being attempted and how reversible it is.
| Dimension | Example rule |
|---|---|
| Verb | Read is allowed; delete, transfer, publish and grant require approval |
| Resource | This agent may act on tickets, never on the billing system |
| Value | Refunds under £50 proceed; above that, a human decides |
| Destination | Data may move between internal systems, never to an external address |
| Rate | Any action taken more than N times in an hour stops and asks |
| Data class | Anything touching records classified personal requires a stricter path |
Rate deserves more attention than it usually gets. Most agent incidents are not one catastrophic action but a correct-looking action repeated past the point of sense. A rate ceiling is the cheapest control in the list and the one most often left out.
Four modes, and why monitor comes first
An enforcement point that only blocks is unusable in practice, because nobody will turn it on. The modes matter as much as the rules.
| Mode | What happens | Use when |
|---|---|---|
| Monitor | Action proceeds, decision is recorded | Always first. You are learning what normal looks like |
| Warn | Proceeds, someone is told | The rule is probably right but you are not certain yet |
| Approve | Pauses for a human | Consequential and irreversible, and a person can decide quickly enough to matter |
| Block | Refused | The action should never happen and there is no legitimate exception |
A rule written straight to block is a rule written from imagination. Run it in monitor first and the log tells you how often it would have fired and on what — which is usually a surprise, and usually the reason the rule gets rewritten before it is enforced.
The explanation is the product
A block that says "denied" generates a ticket. A block that says "attempted
refund of £480; policy refund-ceiling permits £50
without approval; approver is the finance on-call" generates an action. The
difference decides whether anyone keeps the firewall switched on after the first
false positive.
What an agent firewall does not solve
Three things get attributed to this control that it cannot deliver, and assuming otherwise produces a gap nobody is watching.
It does not make the agent correct. An action inside policy is still permitted if the reasoning behind it was wrong. The firewall bounds the consequence; it does not improve the judgement.
It does not cover what it does not sit in front of. Coverage is architectural. An agent with a direct credential to a database the enforcement point never sees is unconstrained, however good the rules are, and that is the failure mode worth auditing for rather than the rules themselves.
It does not decide what should be allowed. That is a business decision about acceptable loss, and it has to be made by people who own the consequence. The most common reason a deployment stalls is not technical — it is that nobody will say what the refund ceiling should be.
Where Agent Trust Cloud fits
| Need | What the platform does |
|---|---|
| A decision point in front of actions | Agent Trust Runtime is where actions are evaluated rather than merely logged after the fact |
| Rules that are not per-integration code | Policy Engine holds the conditions centrally, so a new constrained action does not require changing the agent |
| Evidence a decision happened | Audit Ledger records what was attempted and what the policy did, which is the part an auditor asks for |
| Human decisions on the consequential ones | Approvals route to a person — see human-in-the-loop approvals |
| Set your risk appetite | No. Where the thresholds sit is yours to decide, and it is the step that takes longest. The platform makes a threshold enforceable once you have one |
Common questions about AI agent firewall
Is an AI agent firewall the same as a web application firewall?
No. A WAF inspects requests arriving at an application and decides about traffic — patterns, signatures, rates. An agent firewall sits on the other side and decides about actions an agent is about to take: this refund, this recipient, this deletion. The inputs are structured intent rather than packets, and the rules are about business consequence rather than attack signatures.
Does an agent firewall stop prompt injection?
It bounds the damage rather than preventing the attack. Prompt injection succeeds at the model layer, where the agent accepts instructions it should not have. The firewall sits after that, so an injected instruction to transfer funds still gets generated — it just does not execute if policy requires approval above a threshold. That is a meaningful control, but it is containment, not prevention.
How many rules does a deployment usually need?
Fewer than people expect, and the first ones matter most. A rate ceiling, a value threshold on anything financial, and approval on irreversible verbs cover most of the realistic damage. Rule sets grow by accretion after that, and a large rule set is usually a sign that monitor mode was skipped.
What happens if the enforcement point is unavailable?
That is a design decision you have to make explicitly, and it is the question worth asking any vendor. Failing closed stops the agent when the control plane is unreachable, which is safe and disruptive. Failing open keeps the agent working and removes the control at exactly the moment nobody is watching. Neither is universally right; not having decided is.
Can it constrain an agent that has direct credentials?
No. Coverage is architectural: the firewall governs what passes through it. An agent holding a database credential it can use directly is unconstrained regardless of the rules. Auditing for direct credential paths is more valuable than refining rules on the paths you already cover.