Deno Just Open Sourced Their Agent Firewall

Deno Just Open Sourced Their Agent Firewall ![rw-book-cover](https://img.youtube.com/vi/ZiFoTw6doGI/maxresdefault.jpg) 🔗 **Source:** [Deno Just Open Sourced Their Agent Firewall](https://www.youtube.com/watch?v=ZiFoTw6doGI) > [!note]+ Document Notes > tags: [ai-security, agent-security, network-security, deno, open-source, credential-management] > author: [MISSING] > source: YouTube > reference: https://www.youtube.com/watch?v=ZiFoTw6doGI > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🏷️ Title: Deno Just Open Sourced Their Agent Firewall (Claw Patrol) >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ## 📝 Summary - Deno open-sourced Claw Patrol, a security firewall that sits between AI agents and the internet - Solves three key problems: access control, credential isolation, and observability of agent actions - Uses a gateway architecture where agents route traffic through a central server that manages rules, credentials, and logs - Currently requires HCL configuration files and has some setup complexity, but provides comprehensive security for AI agent operations - Supports various credential types, rule-based access control, and human-in-the-loop approvals ## 📖 Main Content Claw Patrol is an open-source security firewall developed by the Deno team that addresses critical security vulnerabilities in AI agent deployments. The tool implements a gateway architecture where AI agents route their internet traffic through a central server that enforces security policies. ### Architecture Overview The system consists of a gateway server that manages rules, credentials, logs, and a dashboard interface. Multiple machines running AI agents can connect to this gateway and route their traffic through it. Users can choose to run individual commands through the gateway or add entire machines to the security perimeter. ### Three Core Security Problems Addressed **1. Credential Isolation**: Traditional AI agents require direct access to API keys, database passwords, and other sensitive credentials. Claw Patrol stores these credentials on the gateway server and injects them into requests as they pass through, ensuring agents never have direct access to real credential values. This prevents credential exposure through logs, prompt injection attacks, or unauthorized access. **2. Access Control**: The system provides granular control over what actions agents can perform. Using Common Expression Language (CEL), administrators can define rules that inspect and control database queries, API calls, and other operations. For example, rules can block schema changes to databases while allowing read operations, or require human approval for sensitive actions. **3. Observability**: All agent requests are logged and visible in a centralized dashboard, showing exactly what operations agents performed, including the specific API calls, database queries, and responses. This eliminates the need to search through multiple service logs to understand agent behavior. ### Configuration and Management The gateway is configured through HCL (HashiCorp Configuration Language) files where administrators define endpoints, credentials, and rules. The system supports various credential types including Anthropic subscriptions, PostgreSQL connections, and custom bearer tokens. Rules use CEL expressions to evaluate requests and can result in approval, denial, or human-in-the-loop decision making. A profile system allows grouping credentials and rules for role-based access control, enabling different teams to have appropriate access levels. A testing feature allows administrators to replay real requests against rule changes to verify security policies. ### Current Limitations The setup process is currently complex and requires manual HCL file editing. The reviewer experienced issues with IP-based endpoints and found the configuration workflow tedious. The project would benefit from dashboard-based credential and rule management similar to other security tools. ## 🗒️ Notes #### ⏱️ [00:00:00](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=0) Introduction to Claw Patrol - Open-source security firewall by Deno team - Sits between AI agents and internet - Solves three key security problems #### ⏱️ [00:00:30](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=30) Architecture Explanation - Gateway server holds rules, credentials, logs, dashboard - Multiple agent machines can join gateway - Can route single commands or entire machines - Supports Tailscale and WireGuard #### ⏱️ [00:01:30](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=90) Credential Isolation Demo - Configure credentials on gateway (PostgreSQL, Claude, GitHub, APIs) - Agents run without real credentials - Gateway injects credentials into requests - Prevents credential exposure via logs or prompt injection #### ⏱️ [00:03:30](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=210) Access Control Features - Fine-grained control over agent actions - Custom error messages for blocked requests - Rule-based blocking (e.g., prevent DROP TABLE operations) - Human-in-the-loop approval options - LLM-as-judge capability #### ⏱️ [00:05:00](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=300) Observability Dashboard - All requests visible in centralized dashboard - Active session monitoring - Token usage tracking - Request details including API calls and responses - Eliminates need to search multiple service logs #### ⏱️ [00:06:00](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=360) Configuration Setup - Single HCL file configuration - Define endpoints, rules, credentials - Support for multiple credential types - Plugin system for custom credential types - Dashboard interface for filling credential values #### ⏱️ [00:07:30](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=450) Rules and Profiles - Common Expression Language (CEL) for rules - Covers HTTP, PostgreSQL, Kubernetes - Approve/deny verdicts with allowlist/blocklist approaches - Profile system for role-based access control - Test command for validating rule changes #### ⏱️ [00:09:00](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=540) Current Limitations - Setup process is tedious - Issues with IP address endpoints - Needs dashboard-based credential/rule management - Early stage project requiring refinement ## 📚 References - [Claw Patrol GitHub Repository](https://github.com/deno-land/claw-patrol) - [Deno Team](https://deno.land) - [Tailscale](https://tailscale.com) - [Common Expression Language (CEL)](https://github.com/google/cel-go) ## 🗣️ Paraphrase Deno has released an open-source security tool called Claw Patrol that acts as a protective barrier between AI agents and the internet. The tool addresses three fundamental security challenges in AI agent deployments: preventing agents from seeing sensitive credentials, controlling what actions agents can perform, and providing visibility into agent activities. The system works by routing all agent traffic through a central gateway that manages security policies, injects credentials safely, and logs all operations. While the current setup requires technical configuration through code files, the security benefits are substantial - agents can operate without ever accessing real passwords or API keys, administrators can block dangerous operations like database schema changes, and all agent activities are tracked in a central dashboard. ## 📰 Newsletter 🛡️ **New AI Security Tool Alert!** Deno just open-sourced Claw Patrol, a security firewall specifically designed for AI agents. Think of it as a smart proxy that sits between your AI agents and the internet, solving three major security headaches: credential leakage, unauthorized access, and the "what did my agent actually do?" problem. The coolest feature? Your AI agents never see real passwords or API keys - the gateway injects them automatically. Plus, you can set rules like "no dropping database tables" and even require human approval for sensitive actions. Perfect for WordPress agencies using AI tools for client management! While the setup is currently a bit technical (HCL config files), this could be a game-changer for secure AI agent deployments. [Check out the demo](https://www.youtube.com/watch?v=ZiFoTw6doGI) to see it in action! ## ✅ Action Items #### DevRel - Demo: Create WordPress-specific Claw Patrol demo showing AI agents managing sites securely - Content: Develop tutorial series on secure AI agent deployment patterns - Community: Host webinar on AI agent security best practices with Deno team - Documentation: Create integration guides for popular WordPress AI tools and Claw Patrol #### OSPO - Security Management: Evaluate Claw Patrol for internal AI tool governance - Policy & Governance: Draft AI agent security guidelines referencing Claw Patrol patterns - Developer Support: Provide training on secure AI agent architecture principles #### Community - Contributors: Share security patterns and Claw Patrol configurations for common use cases - Maintainers: Consider Claw Patrol integration for AI-powered WordPress tools #### WordPress - Core AI: Evaluate security patterns for AI features in WordPress core - Security: Research AI agent security requirements for WordPress ecosystem - Plugins: Develop security guidelines for AI-powered WordPress plugins - Meta: Assess infrastructure needs for secure AI tool deployment ## 🧪 Hypotheses - AI agent security will become a critical requirement as agent adoption increases in enterprise environments - Gateway-based security architectures will become the standard pattern for AI agent deployments - Human-in-the-loop approval systems will be necessary for high-stakes AI agent operations - Credential injection patterns will replace direct credential access in AI agent systems - Centralized logging and observability will be essential for AI agent compliance and debugging ## 📊 Methodology - Case study analysis: Deploy Claw Patrol with WordPress AI tools to measure security improvement - Comparative analysis: Evaluate Claw Patrol against other AI agent security solutions - Performance testing: Measure latency impact of gateway-based security architecture - User experience study: Assess developer workflow impact of security controls - Security assessment: Test credential isolation and access control effectiveness against common attack vectors ## ❓ Questions - How does Claw Patrol's performance impact compare to direct API access for high-volume agent operations? - What specific security vulnerabilities exist in current WordPress AI plugin architectures? - How could dashboard-based configuration improve adoption rates for security tools like Claw Patrol? - What role should human-in-the-loop approvals play in autonomous AI agent workflows? - How can the WordPress ecosystem establish security standards for AI-powered plugins? ## 🔮 Future Research - Integration patterns between Claw Patrol and WordPress hosting environments - Development of WordPress-specific security rules and credential types for Claw Patrol - Comparative analysis of gateway vs. embedded security models for AI agents - Impact of security controls on AI agent effectiveness and user experience - Evolution of AI agent security standards across different software ecosystems ## 💡 Implications - **Security Practice**: Organizations will need dedicated AI agent security architectures, not just traditional application security - **Development Workflow**: AI agent development must incorporate security-by-design principles from the start - **Compliance**: Regulated industries will require comprehensive logging and control systems for AI agent operations - **WordPress Ecosystem**: AI-powered WordPress tools will need security frameworks to prevent credential leakage and unauthorized actions - **Open Source**: Security tools like Claw Patrol may become critical infrastructure for the AI agent ecosystem ## 🧠 Learning Styles Assessment Reading level estimate: Grade 12 (technical content with specialized terminology) #### 👀 Visual learners - Present: Architecture diagrams, dashboard screenshots, request flow visualizations - Improve: Network topology diagrams, security rule flowcharts, before/after security comparisons #### 🔊 Aural learners - Present: Video demonstration with narration - Improve: Podcast discussion on AI agent security, expert interviews on security patterns #### 🗣️ Verbal learners - Present: Clear explanations of security concepts, analogies to traditional firewalls - Improve: Glossary of AI security terms, plain-language security policy examples #### 🧩 Kinesthetic learners - Present: Step-by-step setup instructions, hands-on demonstration - Improve: Interactive tutorials, sandbox environment for testing security rules #### 🧠 Logical learners - Present: Clear problem-solution structure, rule logic examples - Improve: Decision trees for security configurations, threat modeling frameworks #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion prompts about AI security - Improve: Security working groups, peer review processes for configurations #### 🧘‍♀️ Solitary learners - Present: Self-contained technical documentation - Improve: Self-assessment checklists, independent lab exercises #### 🌿 Naturalistic learners - Present: Security ecosystem analogies - Improve: AI security lifecycle thinking, environmental impact of security overhead ## 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive timestamps - Improve: Alt text for architecture diagrams, ARIA labels for video controls #### Keyboard navigation - Present: Standard video player controls - Improve: Keyboard shortcuts for timestamp navigation, transcript search functionality #### Contrast and readability - Present: Clear video quality, readable dashboard screenshots - Improve: High contrast mode for dashboard interfaces, larger text in code examples #### Text resizing and reflow - Present: Responsive video player - Improve: Scalable dashboard interfaces, readable text at 200% zoom #### Media and captions - Present: Full transcript provided - Improve: Synchronized captions with technical terms, audio descriptions of visual elements #### Forms and interactions - Present: Basic video controls - Improve: Accessible configuration forms for security rules, clear error messages ## 🌍 DEIB Assessment #### Cultural breadth - Present: Global applicability of security concepts - Improve: Multi-region deployment examples, international compliance considerations #### Inclusive language - Present: Technical but accessible explanation - Improve: Avoid military/warfare security metaphors, define all technical jargon #### Neurodiversity support - Present: Structured content with clear sections - Improve: Consistent formatting patterns, predictable information architecture #### Representation - Present: Focus on technical content - Improve: Diverse use case examples, accessibility in security tool design #### Psychological safety - Present: Non-judgmental approach to security challenges - Improve: Emphasize learning over blame for security mistakes ## ✅ Logical Validity #### Strong reasoning - **Problem-solution alignment**: Clear identification of three specific security problems with corresponding solutions - **Architectural logic**: Gateway pattern provides centralized control while maintaining agent functionality - **Evidence-based claims**: Demonstrates actual credential isolation and access control through concrete examples #### Fallacies - **Hasty generalization**: Claims about "every other type of AI attack" being prevented are overly broad without comprehensive testing - **Appeal to novelty**: Implies newer security approach is automatically better without comparison to alternatives - **Survivorship bias**: Only shows successful use cases, doesn't address failure scenarios or edge cases #### Tone of voice - **Enthusiastic but measured**: Shows excitement about the tool while acknowledging current limitations - **Technical but accessible**: Uses appropriate technical terminology with clear explanations - **Honest assessment**: Admits setup complexity and current issues rather than overselling ## 🛡️ DARVO Analysis No DARVO patterns detected. The presentation is straightforward technical analysis without attempts to deflect responsibility, attack critics, or reverse victim/offender dynamics. The reviewer acknowledges both strengths and limitations of the tool objectively. ## 🎯 Conclusion Claw Patrol represents a significant advancement in AI agent security, addressing critical vulnerabilities around credential management, access control, and observability. While the current implementation requires technical expertise and has some rough edges, the core security patterns it implements - credential injection, rule-based access control, and centralized logging - are likely to become industry standards as AI agent adoption scales. For WordPress developers and agencies considering AI tools, Claw Patrol's approach offers a blueprint for secure AI agent deployment. The key insight is that AI agents require fundamentally different security architectures than traditional applications, with security controls built into the infrastructure layer rather than relying on application-level protections. The tool's open-source nature and backing by Deno suggest it will continue to evolve rapidly. Organizations should monitor its development and consider how similar security patterns might apply to their AI agent deployments, even if they don't adopt Claw Patrol directly. ## 🔄 Refactor Appendix — Deno Just Open Sourced Their Agent Firewall (Claw Patrol) ### 📚 Literature Atoms (H3) #### Gateway architecture provides credential isolation for AI agents > [!quote] ID:rw_video_demo > Configure your credentials like Postgres users, Claude subscriptions, GitHub accounts, and any bearer tokens... they don't need any of these credentials to actually make the requests work. They'll simply be injected when that request passes through the gateway. **Context & use**: - Demonstrated at 1:30-3:00 with live PostgreSQL and API examples - Core security pattern that prevents credential exposure via logs or prompt injection **Tags**: #ai-security #credential-management #architecture-patterns **Highlight**: [view highlight](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=90)  #### Rule-based access control enables fine-grained agent permissions > [!quote] ID:rw_video_demo2 > The gateway has actually looked into the Postgres request that my agent made and it's checked it against a rule set that I've defined and thanks to one of my rules, it's denied the drop table request. **Context & use**: - Shown at 4:00-5:00 with database schema protection example - Uses Common Expression Language (CEL) for flexible rule definition **Tags**: #access-control #database-security #rule-engines **Highlight**: [view highlight](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=240)  #### Centralized logging solves AI agent observability challenges > [!quote] ID:rw_video_demo3 > Every single request is visible in the dashboard here... you don't need to spend time combing through all of the logs of the individual services that the agent touched to try and work out what it did. **Context & use**: - Demonstrated at 5:30-6:00 in dashboard walkthrough - Addresses major operational challenge of understanding agent behavior **Tags**: #observability #logging #agent-operations **Highlight**: [view highlight](https://www.youtube.com/watch?v=ZiFoTw6doGI?t=330)  ### 🧠 Permanent Candidates (H4) #### AI agent security requires infrastructure-layer controls not application-layer protections **Claim**: AI agents require fundamentally different security architectures than traditional applications, with security controls built into the infrastructure layer rather than relying on application-level protections. **Evidence pointer**: [[#Gateway architecture provides credential isolation for AI agents]] **Scope & conditions**: Applies when AI agents need access to sensitive credentials and external services; traditional application security assumes human oversight of credential usage. **Links**: - [[Infrastructure security patterns]] — because extends traditional network security - [[Zero-trust architecture]] — because applies-in AI agent deployments - [[Credential management systems]] — because contrasts on access patterns  ### ✏️ Fleeting Queue - Research WordPress AI plugin security vulnerabilities — common patterns of credential exposure - Investigate CEL rule engine for WordPress-specific security policies — database operation controls - Compare gateway vs embedded security models — performance and usability tradeoffs ### → Things 3 (max 2 actions) - [ ] Test Claw Patrol setup with WordPress AI tools — document configuration patterns #things - [ ] Draft AI agent security guidelines for WordPress ecosystem — include Claw Patrol patterns #things --- ## Full Transcript [00:00] This is Claw Patrol, an open- source [00:02] security firewall built by the Dino team [00:03] that sits between your AI agents and the [00:05] internet, and it solves three key [00:07] security problems with AI agents. Access [00:09] is an actual control. Your agent [00:11] shouldn't see secrets, and you can't see [00:13] what your agent did. I've been trying a [00:15] lot of AI agent security tools recently, [00:17] and I really like the approach that Claw [00:19] Patrol has taken here, but it's not [00:21] perfect yet. [00:26] So how claw patrol works is you have one [00:28] server called the gateway which holds [00:30] your rules, credentials, logs and the [00:32] claw patrol dashboard. Then you have any [00:34] number of machines that run agents and [00:36] they can join that gateway and route [00:37] their agent traffic through it. In fact, [00:39] you can choose to run single commands [00:41] through the gateway or you can add your [00:42] entire machine. In my case, my gateway [00:44] is simply a yubuntu server which I [00:46] connect to with tailscale which claw [00:48] patrol supports out of the box as well [00:49] as wire guard or both. and my agents are [00:52] my Mac and my Open Claw server. I'm [00:54] running the OpenClaw gateway through [00:55] Claw Patrol. And on my Mac, I just use [00:57] the single run command with Claude as [00:59] and when I need it. With that bit of [01:01] context, let's look at the three key [01:02] problems that claw patrol solves. And [01:04] I'll actually start with number two, [01:05] which is your agents shouldn't see [01:07] secrets as it leads nicely onto the [01:09] other problems. So on the claw patrol [01:11] gateway, you can configure your [01:12] credentials like Postgress users, claude [01:14] subscriptions, GitHub accounts, and any [01:16] bearer tokens or custom headers like I [01:19] have here for my production API server. [01:21] With this, when we then run our agents [01:23] through the gateway using that claw [01:25] patrol run command, they don't need any [01:27] of these credentials to actually make [01:28] the requests work. They'll simply be [01:30] injected when that request passes [01:32] through the gateway. So if I ask Claude [01:34] to use my API and my database to give me [01:36] an overview of both of these, it's able [01:38] to do so with zero issues. And I can see [01:41] on the commands that it's actually [01:42] running that it's not including any API [01:44] keys for these curl requests, but it [01:46] needs one. And on Postgress, it's just [01:48] using a fake password of X that is [01:51] definitely not the real password, but [01:52] it's still connecting and getting the [01:54] relevant information back. As the [01:56] gateway has actually picked up these [01:57] requests and attached the real [01:59] credentials, this means that the agent [02:00] never has access to the real values. So [02:02] if someone saw my agent logs or tried a [02:05] prompt injection, they would never get [02:06] these credentials as they live on a [02:08] completely separate server and the agent [02:10] has no way to access them. Just to show [02:12] that injection process even cleaner, if [02:14] I run this curl request on my terminal [02:16] here, you can see it's rejected because [02:17] I didn't pass it an API key. But if I [02:20] run the exact same command through claw [02:21] patrol run, the data is returned as [02:23] normal as that API key is being [02:25] injected. The next problem that claw [02:27] patrol aims to solve is that access is [02:29] an action control. Claw Patrol gives you [02:31] really finite control over what an agent [02:33] can do with a request. For example, if I [02:35] use that Postgress skill again, but this [02:37] time I ask it to drop a table and create [02:39] a new one. When it runs, it immediately [02:41] returns a customized error message that [02:43] I've set up saying that schema changes [02:45] only land via migration PRs, not via the [02:48] agent. The gateway has actually looked [02:49] into the Postgress request that my agent [02:51] made and it's checked it against a rule [02:53] set that I've defined and thanks to one [02:55] of my rules, it's denied the drop table [02:57] request. Another way that I could handle [02:58] this is with human in the loop. So I can [03:00] actually make this rule reach out to me [03:02] to approve the action. At the moment, [03:03] this one does only support Slack, but [03:05] more options are coming soon as well. [03:07] There's even an option to use an LLM as [03:09] judge. And the rules are incredibly [03:10] customizable and flexible, so you can [03:12] even have rules like checking your [03:14] customer support API endpoint that sends [03:16] replies, and you can see if there's any [03:17] offensive content, missing greetings, or [03:19] just anything that you don't want leaked [03:21] in that request. And again, all of this [03:23] being done on the request on the gateway [03:25] means that theoretically all of this is [03:27] safe from prompt injections and pretty [03:28] much every other type of AI attack. The [03:31] third problem that claw patrol solves is [03:32] that you can't see what the agent did. [03:34] But with claw patrol, every single [03:36] request is visible in the dashboard [03:38] here. And you can even see active [03:39] sessions as well as tokens used. And if [03:42] you click into a request, you can see [03:43] the relevant details like the Postgress [03:45] command that was actually run or in the [03:47] case of an API call, you can see the API [03:49] request as well as the response that it [03:51] got back. This way, you don't need to [03:52] spend time combing through all of the [03:53] logs of the individual services that the [03:55] agent touched to try and work out what [03:57] it did. And instead, you can just see [03:58] what it did at the point of request. So, [04:00] you should see pretty much everything [04:02] that the agent does. That's the three [04:03] problems that Claw Patrol aims to solve. [04:05] But how is all of this set up? Well, [04:07] once you have Claw Patrol installed, the [04:09] gateway is actually all configured with [04:10] a single HCL file. In here, you define [04:13] the various endpoints that you're going [04:14] to have rules and credentials for. So, I [04:16] have various ones like OpenAI, Slack, [04:18] SSH, Postgress, and so on. So if any [04:21] request goes through the gateway that [04:22] matches one of these, it knows to check [04:24] the rules and credentials. As for the [04:26] actual credentials themselves, the setup [04:28] of that is pretty straightforward as [04:30] well. You say what type of credential it [04:32] is and what endpoint that credential [04:34] should match. There's support for loads [04:36] of credential types like anthropic [04:37] subscriptions, codeex ones, click house, [04:40] postgress, and also the basics like [04:41] bearer tokens and custom headers. So you [04:44] should find it supports nearly all of [04:45] the types that you need. And even if it [04:47] doesn't, you can actually code plugins [04:49] to add your own type. Once you've [04:50] defined a credential in here, all you [04:52] need to do is head to the dashboard to [04:53] fill in the actual value. Setting up [04:55] rules is also fairly easy. You simply [04:57] say the endpoint that the rule is going [04:59] to apply to, and then you write the rule [05:00] using common expression language. So [05:02] this can cover a wide range of things [05:04] like HTTP, Postgress, Kubernetes, and so [05:07] on. After this, you then say the verdict [05:09] for the rule that you've just defined [05:10] with your approve or deny based on it. [05:12] And you'd use a proof here if you were [05:14] creating an allow list based approach [05:15] instead of a block list one. So you'd [05:17] block all by default and then only allow [05:19] certain things. In my case though, I [05:21] just simply used the block list method. [05:23] Finally, another really useful feature [05:24] here is profiles. You can actually group [05:26] your credentials into multiple profiles, [05:28] which means that any rules and endpoints [05:30] attached to those credentials also [05:32] grouped along with it. And this allows [05:33] you to set up a sort of role-based [05:35] control for your agents and your teams. [05:37] So developers can have certain access to [05:39] credentials and different rules for [05:40] them. and maybe another team like a [05:42] support team has different credentials [05:44] and different rules as well. To help you [05:46] out when you're making rule changes, [05:47] there's actually a test command where [05:49] you can download real actions from the [05:50] dashboard and then rerun it against your [05:53] local rule changes to see if any of them [05:55] have changed the outcome so you can spot [05:56] if there's going to be any accidental [05:58] leaks. I must admit, I did actually find [06:00] this setup process a little bit tedious [06:02] and I'm sure it will be improved soon as [06:03] this is very early in the project life. [06:05] But if there was just a simple way to [06:07] add credentials and rules from the [06:08] dashboard, that would be absolutely [06:10] awesome. perhaps something similar to [06:11] how Adguard works where you can just see [06:13] a request coming through and click to [06:15] add a rule or a credential for that [06:16] request. I did also run into a lot of [06:18] issues when I was trying to add [06:19] endpoints that were just IP addresses to [06:21] my local Proxmox server. For some [06:23] reason, it just didn't want to intercept [06:24] those requests and I couldn't see any of [06:26] them coming through on the dashboard and [06:28] it just gave me a bit of a headache. So, [06:30] there's definitely some fixes needed or [06:32] maybe I was just misusing it. But either [06:34] way, yes, it's going to be some work to [06:35] get to a point of usability that doesn't [06:37] interrupt your flow. But that does kind [06:39] of make sense since this is all about [06:41] security and not just sending an agent [06:43] in yolo mode. So, let me know in the [06:44] comments down below what you think about [06:46] Claw Patrol and if you have any security [06:48] tools that you use for your agents. [06:49] While you're down there, subscribe and [06:51] as always, see you in the next one.  📄 **Full text:** ![[Full Document Contents/Articles/Deno Just Open Sourced Their Agent Firewall.md|Deno Just Open Sourced Their Agent Firewall by YouTube]] ## Highlights - context, let's look at the three key problems that claw patrol solves. And I'll actually start with number two, which is your agents shouldn't see secrets as it leads nicely onto the other problems. So on the claw patrol gateway, you can configure your credentials like Postgress users, claude subscriptions, GitHub accounts, and any bearer tokens or custom headers like I have here for my production API server. With this, when we then run our agents through the gateway using that claw patrol run command, they don't need any of these credentials to actually make the requests work. They'll simply be ([View Highlight](https://read.readwise.io/read/01ksnm209h38v8q6x7vwa6ce5p)) - Note: Credential isolation: agents never hold real secrets — the gateway injects credentials as requests pass through. Core pattern against log leakage and prompt injection. - Tags: ai-security, atom/literature/h1, credential-management - really finite control over what an agent can do with a request. For example, if I use that Postgress skill again, but this time I ask it to drop a table and create a new one. When it runs, it immediately returns a customized error message that I've set up saying that schema changes only land via migration PRs, not via the agent. The gateway has actually looked into the Postgress request that my agent made and it's checked it against a rule set that I've defined and thanks to one of my rules, it's denied the drop table request. Another way that I could handle this is with human in the loop. So I can ([View Highlight](https://read.readwise.io/read/01ksnm26pmj6rezzx538kc4asx)) - Note: Rule-based access control via CEL: a DROP TABLE is intercepted and denied with a custom message ("schema changes only land via migration PRs"). Human-in-the-loop is the alternative verdict. - Tags: atom/literature/h1, access-control, database-security - third problem that claw patrol solves is that you can't see what the agent did. But with claw patrol, every single request is visible in the dashboard here. And you can even see active sessions as well as tokens used. And if you click into a request, you can see the relevant details like the Postgress command that was actually run or in the case of an API call, you can see the API request as well as the response that it got back. This way, you don't need to spend time combing through all of the logs of the individual services that the agent touched to try and work out what it did. And instead, you can just see what it did at the point of request. So, ([View Highlight](https://read.readwise.io/read/01ksnm480gvndgts1gyfbknnrs)) - Note: Centralized observability: every agent request (DB command, API call + response, tokens) is visible in one dashboard — no combing through per-service logs to reconstruct what the agent did. - Tags: atom/literature/h2, logging, observability