An Agent Firewall Is the Enforcement Half of a Control Plane
A term is crystallizing. Coder ships an “Agent Firewall”. Pipelock is an open-source “AI agent firewall.” Progent formalizes agent security as deterministic privilege control over tool calls. ActPlane puts “Policy Enforcement for Agent Harnesses” in its title and pushes it into the kernel. Nobody coordinated this. That’s what makes it worth paying attention to.
The convergence is coming from three directions at once.
Products. Coder runs terminal agents inside a jail, routes their traffic through a proxy, enforces a domain allowlist, and streams every allow/deny decision to a control plane. Pipelock sits between the agent and the network, scans HTTP, WebSocket, and MCP traffic, and signs action receipts from outside the agent’s trust boundary — evidence that doesn’t depend on the agent vouching for itself. Both teams independently reached for the word firewall, and both aimed it at actions, not packets.
Papers. Progent’s core move is the one I’d defend in front of a whiteboard: represent privilege as symbolic rules over tool names and arguments, validate every call through a deterministic procedure, least privilege at the point of impact. ActPlane pushes back on where the interception should live — tool-call checks can miss indirect execution paths, so it enforces in the OS via eBPF. The papers disagree about the layer. Neither disagrees about the thesis: policy belongs in the execution path, on the action.
Practice. We read the guardrails of eleven agent harnesses and asked what still stops a catastrophic command in each one’s full-auto mode. Almost nothing. Every vendor’s answer, in effect, is that safety is the developer’s homework. Operators who’ve been burned once already do the homework — they install a check the harness’s own settings can’t switch off. They just didn’t have a name for it.
Now they do. I think the name is right, and I’ve written up the definition I’d defend: an agent firewall inspects and enforces policy on an agent’s actions — tool calls, commands, file writes — in the execution path, deterministically, before they run.
The definitional claim
Here’s the line I want to draw carefully, because it’s where the naming gets consequential.
A firewall is enforcement: deny, ask, or allow, decided at the action, before execution. That is the sharpest edge of agent governance — the part that turns a policy from a document into a floor. But enforcement alone answers only one question: may this action run?
Running agents in production forces three more:
- Who is acting? A verdict without identity is trivia. You need every decision attributed to an agent, a run, and the human it works for — across Claude Code, Codex, Hermes, whatever your team actually uses, because real orgs are multi-harness whether they planned to be or not.
- What is it costing? Spend is an action surface. A runaway loop is money executing without review, and the firewall’s hook never sees it — that lives on the model wire, a different vantage point with its own blind spots.
- What happened? One audit trail, same identity and same policy on every row, whether the row is a blocked delete or a metered model call. Split the log and you’ve split the accountability.
That larger thing — enforcement plus identity plus cost plus audit, across every harness — is a control plane. The firewall is its enforcement half. Coder’s docs gesture at the same structure from the other side: their firewall streams decisions to a control plane. The pattern wants both halves.
So: you need the whole plane, and the firewall is its sharpest edge. Run enforcement without the rest and you have verdicts you can’t attribute, spend you can’t see, and evidence split across tools. Run the rest without enforcement and you have a very well-documented incident.
Credit where it’s due — Coder, Pipelock, Progent, and ActPlane are each building or formalizing a real piece of this, and the category is better for every one of them. The pattern is converging because the problem is real: agents act, and actions need a policy decision at the only moment they can be stopped.
That’s the half we’ve built ACP around. The pillar page has the full anatomy; getting started takes about a minute.