The Leak You Forget to Filter
You can put three fences on the way in and still leak, because the agent legitimately fetched data it was allowed to and then said it to the wrong person. The breach is on the way out, and nothing inbound was ever going to catch it.
I spent a whole piece on the three fences that guard an agent’s requests on the way in. Scoped service account, a query the agent can’t steer, a tool that authorizes every id before it reads. I believed in those fences. I still do.
Then I watched a system leak with all three standing.
The agent did nothing wrong
Here is the part that took me a beat to accept. The agent did not break out of anything. It asked for data it was allowed to have, and the fences let it through, correctly. Then it wrote a response, and the response went to someone who should not have seen part of what was in it.
Nothing on the inbound path was ever going to catch that. The inbound fences ask “can this agent reach this data.” They have no opinion about what the agent says next. The breach was not a request. It was a sentence.
Two shapes of it show up over and over. A secret gets fetched for some legitimate internal reason and ends up pasted into a summary that a user reads. Or the agent pulls a record it is entitled to read, one that happens to carry a staff-only field, an internal note, a risk flag, and echoes that field back to the user who owns the record but was never meant to see that part of it. Both times the read was allowed. The recipient just wasn’t entitled to the piece that came back. The leak was the output.
Notice what that second shape needs to catch it. It is not a bad pattern in the text. The name, the id, the note are all real and well-formed. Deciding they should not go to this recipient takes something the inbound fences never had: who the recipient is and what they are entitled to.
Egress is a fence too
So you put a fence on the way out.
The last thing the harness does before a response leaves is look at it. Scan the outbound text for the shapes you know are dangerous: secret patterns, cross-tenant identifiers, personal data the recipient has no claim to. Then redact it or block the whole response. This is output DLP, data-loss prevention, and it belongs exactly where the other fences do. In the harness. Below the agent. Not in an instruction that asks the model, please, to be careful what it repeats.
Where it sits is the mirror of the inbound story. The three fences cap what the agent can reach. This one checks what it is about to say, at the last point you control before the words reach a person. Same posture, opposite direction.
A detector is not a guarantee
I want to be careful here, because this fence is a different kind of thing from the others, and pretending otherwise would be the exact hand-waving I keep complaining about.
The egress filter is a detector. It sits at the same layer as the inbound scanner, in the harness, but the two are looking for different things: the inbound one watches for adversarial instructions coming in, this one watches for sensitive data going out. And like any detector it works by recognizing what it was taught to recognize, whether that is a fixed pattern or a smaller model asked to judge the text. Either way it is probabilistic. It can be evaded, and it can miss. So it is layered for depth, and it is never load-bearing on its own.
The load-bearing parts are the capability fences from the earlier pieces. Those are structural. They do not try to recognize an abuse and stop it. They remove the authority, so the abuse has nothing to act on. A scoped service account does not detect a cross-tenant read and block it. It makes the cross-tenant read impossible to express.
That is the distinction I hold onto. The capability fences are the trapeze. Egress DLP is the net under it. You want the net. You do not walk the wire because you have one.
Guard both ends
There is one more piece after this, and it is the obvious question once you have fences pointing both directions and a scanner doing double duty: how do you avoid building all of it by hand, again, for every new agent and every new tool. That is its own story.
For now the correction is small and it stuck with me. I used to picture agent security as a wall around the input. A whole class of leaks was waiting quietly at the exit. Guard both ends, and when you do, trust the fences that remove authority over the filters that only recognize its misuse.