Category
Enforcement architecture
10 posts
-
Allowlist, denylist or both? Designing MCP server policy after GitHub's enterprise allowlists
An allowlist stops servers nobody approved. A denylist stops approved servers that later turn bad. MCP policy needs both, matched on URL or command, never on name alone.
-
Lethal trifecta audit: a worksheet to find agent setups that mix private data, untrusted content and egress
Exfiltration risk comes from a combination: private data, untrusted content and a way to send data out, in one agent session. This worksheet audits each configuration for all three and shows which leg is cheapest to break.
-
Known bad, no known bad, unknown: a three-state policy model for agent artifacts
Most agent artifacts have never been checked by anyone. Splitting verdicts into known bad, checked with nothing found, and never checked lets policy block, log or ask a person without calling unreviewed code safe.
-
Five Claude Code hook settings that quietly turn agent enforcement into advice
Exit 1 does not block. A timed-out hook does not block. The if filter is best-effort. Plugin tools carry prefixed names. User hooks merge in unless managed-only mode is on. Check all five before you call a hook a control.
-
Egress allowlisting for coding agents and CI runners: the control that would have stopped the axios callback
Most agent-ecosystem malware has to phone home. An outbound allowlist on CI runners and agent sandboxes contains compromises that known-bad lists miss. Start in audit mode, then block. The ongoing cost is keeping the list current.
-
Skill scanning in Claude Enterprise skips API uploads, pre-existing skills and ZDR orgs: closing the gaps
Claude Enterprise skill scanning checks new uploads and edits in claude.ai and Cowork. Anthropic's docs say it skips Skills API uploads, pre-existing skills, and CMEK, ZDR and HIPAA-ready orgs. A control for each gap.
-
Prove your agent policy fires: a harmless canary suite for Claude Code hooks and MCP allowlists
Several hook and allowlist settings fail open without an error. Plant harmless canary entries that a working policy must block, test them on every release, and keep the results as audit evidence.
-
A classifier that misses 17% of overeager actions: layering model-based approval over deterministic deny rules
Anthropic's auto-mode classifier misses 17% of real overeager actions in its own evaluation. It is a good middle layer. Known-bad artifacts, credential reads and irreversible actions need rules that never consult it.
-
Approval prompts are not a control when people approve 93-97% of them: what Anthropic's data means for policy
Anthropic's own studies show users approve 93-97% of permission prompts and caught 13.6% of planted dangerous commands. Keep human sign-off for a short list of irreversible actions and use rules and logs for the rest.
-
Where should an agent artifact check run? Hook vs package wrapper vs gateway vs registry, by what each can see
Each enforcement point sees a different slice. Hooks see agent tool calls, wrappers see package resolution, gateways see network traffic, registries see uploads. Place checks by the artifacts and failure modes you actually face.
