{"slug": "i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it", "title": "I put a firewall in front of my AI agents. Here is the near-miss that made me build it.", "summary": "A developer built Bastion Gateway, a firewall for AI agents, after a near-miss where a research agent attempted to drop a database table. The gateway enforces allowlists for tools, domains, and endpoints, denying everything else by default. It produces signed audit logs for compliance and is available as open-source under Apache-2.0.", "body_md": "Your agents can delete, spend, email, and leak — at machine speed, without asking.\n\nNothing is standing in front of them.\n\nSo I built one.\n\nI was testing a research agent against a sandbox database. The prompt was routine: \"clean up the database — drop the customers table.\"\n\nThe agent reasoned, formed the call, and fired it.\n\nThe response came back: `403 Forbidden`\n\n.\n\nThe table was still there.\n\nThat microsecond between the call and the 403 is why Bastion Gateway exists.\n\nEarlier this year I published the [Agent OSI model](https://workswithagents.dev) — seven layers of agent infrastructure. Two layers were empty: **L2 (identity)** and **L7 (governance)**.\n\nOrchestration, memory, and skills are well served by existing tools. But nothing stood between an agent and the thing it was about to delete. That is the gap between an agent that works and an agent you can put in production.\n\nBastion Gateway fills those two layers.\n\nA wall with one gate. Name the tools, domains, and endpoints each agent may touch. Everything else is denied by default. That is the whole posture.\n\nIt does four things:\n\nThe audit log is the point. Proxies commoditise. Signed, buyer-acceptable evidence of what an agent did and did not do is what still matters in two years.\n\nEvery decision — ALLOWED, DENIED, HELD — is appended to an ed25519-signed JSON log. The format follows the Compliance-as-Code evidence spec (published on workswithagents.dev).\n\n`bastion export`\n\nproduces an evidence pack. This is the artefact that auditors, compliance teams, and buyers will ask for.\n\nThe gateway makes no outbound calls except the traffic you route through it. No telemetry, no phone-home, no account.\n\nRead the source. Apache-2.0. Run it yourself.\n\n```\ndocker run -p 8080:8080 \\\n  -v ./policy.yaml:/policy.yaml:ro \\\n  ghcr.io/vystartasv/bastion-gateway\n```\n\nPoint your agent's `base_url`\n\nat `http://localhost:8080`\n\n. That is the only change.\n\nSelf-host is live and free. A hosted version — long-term evidence retention, phone approvals, team policies — is a waitlist, not a promise.\n\nThis is infrastructure, not promises.", "url": "https://wpnews.pro/news/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it", "canonical_source": "https://dev.to/vystartasv/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-build-it-13oe", "published_at": "2026-07-13 22:14:34+00:00", "updated_at": "2026-07-13 22:50:37.741534+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["Bastion Gateway", "Agent OSI model", "workswithagents.dev"], "alternates": {"html": "https://wpnews.pro/news/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it", "markdown": "https://wpnews.pro/news/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it.md", "text": "https://wpnews.pro/news/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it.txt", "jsonld": "https://wpnews.pro/news/i-put-a-firewall-in-front-of-my-ai-agents-here-is-the-near-miss-that-made-me-it.jsonld"}}