Security Firewall for Agents

Deno Deploy has outages, and its PagerDuty alarm can wake someone in the middle of the night. Ryan Dahl, Deno’s CEO and the creator of Node.js, describes using OpenClaw and other agents to service those incidents automatically. To investigate effectively, the agents receive read-write access to Postgres, Kubernetes, ClickHouse, AWS, GitHub and Slack. They can inspect traces, find which projects a user owns in the production database, and follow communications and logs. Dahl reports that they resolve incidents that previously required a human SRE, though he gives no measured resolution rate.

The same access permits destructive actions. An agent could launch psql and attempt to delete the users table, or run kubectl delete namespace prod. An incident-response system needs enough authority to repair production without being allowed to interpret removing production as a repair.

Dahl says Opus repeatedly refuses requests to delete the users table. That is useful behavior, but it cannot be the security guarantee. These SRE agents read support-system content supplied from outside the company, creating a path for prompt injection. A manipulated agent might believe a destructive operation is the correct next step. Treat the agent as untrusted software: the component choosing an action cannot also be the only component guarding it.

Deno runs its agents on standalone VMs and treats local filesystem isolation as handled at that layer. Under this deployment model, the consequential interactions with production systems cross the network. Those bytes can originate in an MCP tool call, but they can also come from an ordinary subprocess. A spawned psql client speaks the Postgres wire protocol, not HTTP. An enforcement point must understand the resulting traffic regardless of which agent tool produced it.

The route can be indirect. Deno’s production Postgres database sits inside an AWS VPC and is reached through an EKS endpoint. The requirement is to let the agent use that access while preventing it from tunneling through EKS, launching psql and dropping the users table. A destination-level permission is insufficient to express that distinction: the policy must understand SQL even when the database connection travels through another system. This preserves the sort of investigative reach a human SRE would have while constraining the operation performed at the destination.

Read-only database credentials and ACLs remain useful, and Dahl explicitly recommends careful credential provisioning. The difficulty is maintaining those permissions across many services and accounting for how they compose: access to one system may provide a route into another. Carefully permissioned MCP tools address their own calls, but an MCP-only boundary does not govern a separately spawned psql process. Once subprocesses are allowed, enforcement must follow their external effects too.

Several existing approaches address parts of this problem. Dahl’s comparison turns on where each control observes the agent’s behavior:

Provider guardrails do not by themselves inspect a database operation, and HTTP rules do not describe the Postgres wire protocol. Credential substitution keeps secrets away from the agent, but does not by itself decide whether an authenticated operation is acceptable. Process isolation addresses another part of the deployment; Deno already uses standalone VMs for that purpose.

This comparison describes the roles emphasized in the talk, not an exhaustive inventory of those projects. Current CrabTrap documentation specifies deterministic rules followed by an LLM judge for outbound requests; upstream responses pass back without inspection. Current OpenShell documentation also includes network and inference controls, so its scope extends beyond the local isolation features highlighted here.

Claw Patrol is Deno’s MIT-licensed, open-source proxy for this boundary. It operates below an HTTP-only abstraction, parsing supported protocols so rules can govern the actions they carry. It also holds credentials and injects them into outgoing traffic, keeping real secret values out of the agent software. The agent can request an operation; the proxy independently controls whether and how it reaches the outside world.

Permissions live in a configuration file written in HCL, the configuration language also used by Terraform. Deno checks that file into Git and reviews its changes carefully. Dahl describes Deno’s policy file as approximately 1,000 lines. HCL supplies the configuration structure; the current Claw Patrol README specifies CEL expressions for rule conditions.

The displayed policy example blocks selected Postgres functions. Its significance is that the rule concerns a database operation, rather than an HTTP method, and can apply when the connection is tunneled through another system. Claw Patrol supports multiple protocols and offers a plugin system for extending that support when a new protocol is needed.

The prerecorded demonstration runs Codex under Claw Patrol in YOLO mode, allowing it to act on the instruction to delete the users table. The destructive SQL operation at issue is:

DROP TABLE users;

The important sequence is the attempted action and its rejection:

1. Codex receives the instruction and starts a psql subprocess to carry it out.
2. The subprocess opens a Postgres connection that passes through Claw Patrol.
3. Claw Patrol parses the protocol and evaluates the operation against its rules.
4. The proxy rejects the destructive action before it can carry out the requested deletion.

The demonstration does not depend on Codex refusing the instruction. It shows enforcement after the agent has chosen to comply, at a boundary that also covers the subprocess it launches.

Claw Patrol’s dashboard shows devices or agents alongside the actions flowing through the proxy, including denied actions and actions awaiting approval. Opening an action reveals its details, and analytics help operators understand agent activity. The term action matters: the inspected unit can be a database operation or another protocol-specific interaction, not just an HTTP request.

Rules can do more than reject traffic. An action can enter an approval workflow:

• Human approval: Ask an operator in a Slack channel.
• LLM judgment: Have a separate model evaluate the action.
• Combined checks: Obtain an LLM judgment first, then request approval in Slack.

These are decisions about whether a pending action may proceed, not reports that it has already executed. The ordering lets operators place precise checks around external effects.

The agent remains an unmodified black box. It does not need to implement the dashboard, follow an internal approval convention or enforce the proxy’s decision itself. The control sits outside the software being constrained.

Credential injection has to accommodate more than bearer headers. Dahl describes handling cookies, Postgres and ClickHouse authentication, OAuth protocols and AWS SigV4. These schemes require different treatment at the protocol boundary; a single header-replacement mechanism would not cover all the services in Deno’s environment. The implementation grows out of those operational requirements.

Deno runs its agents inside a Tailscale tailnet, with Claw Patrol acting as a Tailscale exit node. Tailscale identity also authenticates access to the dashboard, avoiding a separate authentication mechanism there. WireGuard provides an alternative for deployments that do not use Tailscale. Dahl describes this arrangement as keeping the sensitive infrastructure off the public internet and tightly controlled.

Moving credentials out of the agent creates a component that deserves particularly careful protection: Claw Patrol itself holds access to production systems. External enforcement does not eliminate trust; it places that trust in a separately controlled proxy instead of in the agent making requests.

The security boundary must remain outside agent software. A security plugin or modification inside an untrusted agent shares the same fundamental trust problem. Alignment remains valuable, but production access also needs an independent enforcement mechanism. Claw Patrol is Deno’s practical implementation of that separation.

The first audience question asks how to test whether the system works properly. Claw Patrol’s rule file has an accompanying test mechanism: provide fixture requests or actions, run them through the rules, and assert that specified requests remain blocked. These are policy regression tests, distinct from the broader software test suite that Dahl also reports maintaining. The answer describes a testing mechanism, not a measured security coverage result.

The final question asks whether smarter agents make this problem bigger or smaller. Dahl expects better context and alignment to reduce problematic behavior: an agent that better understands the company and its responsibilities should make fewer destructive choices. He describes Opus as more aligned than earlier models, but still expects independent security backstops to remain necessary. Greater confidence in the agent’s judgment does not remove the need to constrain what its production access can do.