Skip to main content
An agent reaches nothing outside the platform by default. The model gateway and the platform API (context.api_url) always work; everything else — a public API, your CRM, a database — must be allowed by a rule. You list what your agent needs in agentos.yaml. Environment admins can add or block hosts live on the agent’s Guardrails tab; see Network guardrails.

​
Allow hosts in agentos.yaml

agentos.yaml
The list belongs to the version: it is fixed when you deploy, like its config. network has only the allow key; block rules and the log-only switch are for admins, so an agent’s own file can’t switch the checks off. At most 200 rules.

​
Rule syntax

A host that resolves to a private address (10/8, 172.16/12, 192.168/16, fc00::/7, 100.64/10) is only allowed by an IP or network rule that covers it, never by a host name. A public name pointing inside your network is how SSRF attacks work.
Some addresses can never be opened by any rule: loopback, link-local (including cloud metadata at 169.254.169.254), the Docker host, the platform’s own services and other agents.

​
How your code connects

Every agent container gets proxy variables when it is created: Most HTTP clients follow these on their own: Python’s requests, httpx, urllib and aiohttp (with trust_env=True), curl, Go, and Node 24+ fetch. A client that ignores them simply reaches nothing outside the platform. HTTPS goes through as an end-to-end encrypted tunnel: the proxy sees the host and port, never a path, header or body.

​
When a connection is blocked

The proxy answers 403 with a sentence naming the host and why:
Every connection your agent tries — allowed or blocked — appears on the agent’s Guardrails tab under Where it connected, where an admin can allow a blocked host with one click.
Not sure what a new agent needs? An admin can put the agent in log only mode: connections no rule allows go through and are recorded as WOULD BLOCK. Copy what you see into network.allow, then switch back to enforce.