Build an outbound network allowlist for AI tools

URL validation inside an agent tool is incomplete if the runtime can still reach arbitrary hosts. The network layer should enforce the same narrow destination policy as the application.

Define the measurable control

Inventory each tool’s required scheme, host, port and path class. Default deny, resolve destinations through controlled DNS, reject private and link-local ranges, limit redirects and route traffic through an observable egress point. Bind credentials to the intended audience.

The AI reliability lab makes the decision reproducible with authored data:

from reliability_cases import egress_allowlist_case

result = egress_allowlist_case()
assert result["decisions"] == [True, False, False]
assert result["allowed_destinations"] == 2
assert result["default"] == "deny"
assert result["network_called"] is False

The lab permits the approved HTTPS CRM destination and denies a metadata-service address plus an unlisted domain. It makes no network call. The separate dns_rebinding_test reminder shows that string comparison alone is not a complete production control.

Challenge the result

Wildcards and open redirectors enlarge the allowlist silently. Validate the final connection after DNS resolution and each redirect. Deny user-supplied schemes and ports, cap response size and time, and record destination decisions without leaking tokens.

Keep a reviewable evidence pack:

• tool-to-destination inventory
• application and network policy
• SSRF, redirect and rebinding tests
• denied-egress alert and investigation runbook

This work aligns with the evaluation, security, cloud operations, reliability and FinOps sequence in the FDE for Professionals course. The linked course describes the learning pathway; this article’s numbers are synthetic and do not report a model, client, audit or production result.

Practice task

Create three fake destinations: approved API, link-local metadata and attacker domain. Verify application denial and state how the network independently enforces it.

Continue learning

This article is part of the Advanced AI reliability and assurance sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Threat-model tool misuse and data exfiltration paths.
• Continue with Design a secret-rotation drill for an integration service.

Reference: OWASP: Sensitive Information Disclosure.