The Case for External Security Boundaries

When deploying AI agents with write access to production systems (Postgres, Kubernetes, AWS), internal model alignment is insufficient. Even highly aligned models like Claude 3 Opus can be manipulated via prompt injection through support systems or other external inputs. Because agents can spawn subprocesses (e.g., psql) to tunnel through endpoints, security cannot rely on the agent to police itself or on HTTP-layer guardrails. The security boundary must exist outside the agent, treating it as an untrusted black box.

Claw Patrol: Wire-Level Proxying

Claw Patrol is an MIT-licensed proxy designed to sit in front of agents and intercept communication at the byte level, below the HTTP layer. This allows it to inspect and restrict non-HTTP protocols, such as the Postgres wire protocol, preventing destructive actions like dropping tables even if the agent is running in a compromised state.

Key features include:

  • HCL-based Rules: Security policies are defined using HashiCorp Configuration Language (HCL), allowing teams to manage permissions as code, check them into git, and run unit tests against fixture requests.
  • Credential Injection: The proxy holds all production credentials (including OAuth, cookies, and AWS SigV4). The agent never sees these secrets, receiving only placeholders, which mitigates the risk of credential exfiltration.
  • Multi-Stage Approval: Rules can trigger automated workflows, such as requiring an LLM judge to verify the safety of an action or routing requests to a human in Slack for manual approval.
  • Protocol Plugins: The system is extensible, allowing for the addition of new protocol parsers as needed.

Operational Security

To maintain a secure environment, Claw Patrol is designed for real-world production use cases:

  • Network Isolation: It can be deployed as a Tailscale exit node, ensuring that all agent traffic remains within a private tailnet and off the public internet.
  • Observability: A dashboard provides visibility into agent activity, showing denied requests and pending approvals, which is essential for auditing and debugging agent behavior.
  • Testing: The rule system includes a built-in testing framework, allowing developers to verify that specific "nefarious" requests are correctly blocked before deploying policy changes.