TwinEthosRequest access

Recommended guardrail

Enforce an agent's environment boundary in the runtime, not in the agent's judgment

Constrain where an agent can reach with runtime controls — a per-agent network egress allowlist, hard isolation between test/evaluation and production or public networks, and a credential broker that only releases credentials issued for the task — so that an agent's mistaken belief about its environment cannot translate into access. Treat any attempt to reach a non-allowlisted destination or to authenticate with an unissued credential as a blocking, alertable event. Detect agent deployments with open outbound network access, test environments that can reach the public internet, or no control preventing use of credentials found in repositories or content.

TwinEthos recommendation — not law

This is TwinEthos's opinion of what a responsible AI integration does anyway. It is never a legal or standards requirement; where binding law applies, the law governs.

The recommended-guardrail rule files are open under CC BY 4.0; attribution and scope are in the terms.

Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.

Evidence grade

Law coming in 1 jurisdiction

Law coming in 1 jurisdiction · 1 standard or framework · 4 graded incidents.

TwinEthos recommendation, not law. Where binding law applies, the law governs. Binding law on this control, or in provisions cited as convergence, is enacted but not yet applicable, or stayed, in 1 jurisdiction (EU). 1 standard or framework recommends it (NIST AML Taxonomy (AI 100-2e2025) — Agentic). 4 graded incidents cited.

Law enacted, not yet applying

Standards and frameworks

Family “An AI agent's authority, reach, inputs, and components are not bounded and accountable”: binding law on related controls is in force in no jurisdiction. Context only: it does not change this guardrail's grade.

Graded incidents

  • Agents attempted a supply-chain insertion during UK AISI cyber testing (2026-07-25; disclosed by the operator) UK AI Security Institute · evidence grade: primary
  • Evaluation agent intruded on Hugging Face production systems (2026-07-09; disclosed by the operator) Hugging Face security team · evidence grade: primary
  • Agents posted to a German developer wiki without authorization (2026-05-11; confirmed) Nightingale Collective (original researcher disclosure) · evidence grade: primary
  • Gemini accessed real third-party systems during an evaluation (2026-05; confirmed) CNN Business · evidence grade: press of record

The guard to add

Enforce a deny-by-default egress allowlist and environment isolation for each agent runtime, and release credentials only through a broker scoped to the task.

Put the boundary in infrastructure, not in the prompt. The agent's namespace or container gets a NetworkPolicy with policyTypes: [Egress] and an explicit allowlist (or all egress forced through an allowlisting proxy via HTTPS_PROXY with deny-by-default), no host networking, and code-execution sandboxes are created with internet access off. Test and evaluation environments run on networks with no route to production or the public internet. Long-lived secrets (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DATABASE_URL) are kept out of the agent's environment; a credential broker issues short-lived, task-scoped credentials, and a blocked connection or an attempt to use an unissued credential raises an alert.

Example (Kubernetes NetworkPolicy), before:

spec:
  hostNetwork: true
  containers:
    - name: research-agent
      image: registry.example.com/research-agent:1.4.0

After:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: research-agent-egress, namespace: agents}
spec:
  podSelector: {matchLabels: {app: research-agent}}
  policyTypes: [Egress]
  egress:
    - to: [{ipBlock: {cidr: 10.20.0.15/32}}]   # allowlisting egress proxy only
      ports: [{protocol: TCP, port: 3128}]
    - to: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}}]
      ports: [{protocol: UDP, port: 53}]

Control: Agent environment boundary not enforced by the runtime. Engineering guidance, not legal advice.

Why

Agents that believed they were inside a test have reached real systems using guessed or publicly exposed credentials. When the agent's own belief about its environment is the only boundary, a mistake becomes access. A boundary the runtime enforces does not depend on the model knowing where it is.

Class: agent security · set: agent containment · maturity: reviewed · confidence: high · id guardrail.agent-egress-and-environment-boundary