Fleet 2.9.1 is out.See what's new →
FleetFleet
Glossary

Destination-Level Egress

Destination-level egress grants an agent connectivity to a specific host or SNI for a bounded window. Merge, delete, and install stay on other controls.

A destination grant answers 'may this process open a connection to registry.npmjs.org for the next N minutes?' A merge approval answers a different question. A grant to a package registry does not authorize a git push. A merge approval does not open the public internet.

Fleet grants name a host. An unknown host parks blocked_on_egress without holding a socket. Approvals copy the parked host so a caller cannot swap it after the human has seen the request. Hostname grants that rebind to loopback, link-local, metadata, or RFC1918 are refused at dial time. When the grant expires or is revoked, tracked relays close; new dials are denied.

Missing intercept, iptables, or an unproven grant denies outbound traffic.

How this relates to Fleet

A human grant enables that host. Workload identity cannot self-approve. Prove it at /security#containment.

Frequently asked questions

Does a destination grant let an agent merge a pull request?

A grant authorizes connectivity to a host or SNI. Merge, delete, and other actions are separate controls.

Can the agent approve its own destination?

No. Workload, MCP, and in-sandbox callers are refused. A human grant is required. Fling (notification) is not authorization: a delivery outage does not mint a grant.

Keep your AI agents from escaping

Jail Fleet-launched Linux agents, then run saved workflows with review, approvals, and an audit trail. Prove it at /security/#containment.