Skip to content

Learn · Guides

Run an agent on a leash

Give an AI helper a job, a short list of tools, and a person to sign off.

Checked against the product on · written for people writing code

An agent reads what it is given, proposes an action, and stops. What it can reach is set by the connectors you bind to it. With no connectors bound, it reaches nothing.

Safe by default. An agent proposes. The act of writing to your systems runs through the same review gate a rule uses, so an agent holds no authority a person has withheld.
console.dmzagent.com/agents/new

Automate

New agent

1
Name
Ticket triage
What it does
Read an inbound ticket and propose a queue and a priority.
May reach
ticket-apiConnectors. Anything unlisted is unreachable.
Ask a person before acting
Yes
2CancelDry runCreate agent
Figure. The new-agent form. The reachable list is the whole of what the agent can touch. The new-agent form: name, instruction, the connectors it may reach, and the sign-off setting.

  1. Open Agents, select New agent, and write the job in one or two sentences.1

    The text is the instruction the agent runs on. Plain language works.

  2. Bind the connectors it needs, then select Dry run.2

    A dry run proposes without dispatching. Read the proposal before you create the agent.

Watch it work

console.dmzagent.com/agents

Automate

Agents

1All statesNew agent
2
AgentJobMay reachSign-offState
Ticket triageSort inbound ticketsticket-apiRequiredRunning
Plant watchSummarise excursionsplant-otelRequiredRunning
Doc drafterDraft change notesnoneNot neededPaused
3An agent reaches only the connectors its envelope names. With none bound, it reaches nothing.
Figure. The agents list, with the reachable set and the sign-off setting on every row. The agents list: each agent with its job, the tools it may reach, whether sign-off is required, and its state.

  1. Open Agents and confirm the state reads Running.1

  2. Read the May reach column.2

    This is the full set of hosts the agent can send a request to.

  3. Read the default-deny line.3

What holds the leash

GuardWhat it doesWhere it runs
The envelopeNarrows a step to the tools its node names, within the grant the agent holds.At the call site, on every tool call.
The egress checkDerives the reachable hosts from the bound connectors and checks every outbound call.Before DNS on the first request, and again on every redirect.
The review gateHolds a sensitive action for a person.On the proposal, before dispatch.
The logbookWrites the step, the proposal, the decision, and the outcome.On every step.
Note. The egress check is enforced inside the process that runs the step, at the one function every outbound call passes through. Code that opened its own socket would go around it, which is why no customer-supplied code runs in our runtime. Container and namespace isolation is in build.
Ask the assistant to wire this in →Open your organization