Security Firewall for Agents — Ryan Dahl, Deno

Deno addresses the critical security challenge of AI agents with production write access by introducing Claw Patrol. This MIT-licensed proxy operates below the HTTP layer, deep inspecting all agent communications (including non-HTTP protocols), enforcing granular HCL-based rules, and handling credential injection. It allows for human or LLM approval workflows, ensuring robust, external security against prompt injection and malicious actions, as agents are fundamentally considered untrusted software.

August 17, 2026 4 min read

Security Firewall for Agents — Ryan Dahl, Deno — source: https://www.youtube.com/watch?v=MkRYPFIMCSA

Ryan Dahl, CEO of Deno, discusses the critical security challenges of deploying AI agents with direct read and write access to production systems for incident response. Deno Deploy utilizes agents like OpenClaw to automate incident resolution across various systems including Postgres, Kubernetes, ClickHouse, AWS, GitHub, and Slack, significantly reducing human pager duties. However, granting such extensive access introduces substantial risk, as agents could be manipulated to perform “nefarious things” like DELETE USERS TABLE via psql subprocesses or kubectl delete namespace prod.

Dahl emphasizes that even highly aligned LLMs like Opus, which typically resist destructive commands, are insufficient for security. “Security cannot be wishful thinking that Opus will always obey your wishes.” Agents connected to support systems are susceptible to prompt injection, making them untrustworthy. The core thesis is that agents must be treated as “untrusted software”; the security guard cannot reside within the agent itself.

Existing security measures fall short:

ACLs and Permissions: While essential, their complex provisioning across numerous systems can lead to “composition of access” vulnerabilities.
Managed Control Plane (MCP) Tools: These break down when agents spawn subprocesses (e.g., psql), bypassing HTTP-centric tool definitions. An agent can tunnel psql through an EKS endpoint to a production database, a scenario existing HTTP proxies or MCP tools would miss.
LLM Gateways (OpenRouter, LightLLM): Operate at the LLM layer, guarding against prompt injection but not direct system interactions.
HTTP Proxies (HTTP jail, Crabtrap): Confined to the HTTP layer, they fail to inspect non-HTTP protocols or complex tunneling scenarios.
Credential Injectors (Agent Vault): Provide only a partial solution by handling credential secrecy, but don’t control the actions themselves.
Process Sandboxes (OpenShell): Address OS-level isolation, which is less relevant if agents run on isolated VMs.

Deno’s solution is Claw Patrol, an MIT-licensed open-source proxy designed to sit in front of AI agents:

Deep Protocol Inspection: Unlike HTTP-only solutions, Claw Patrol operates at a lower level, understanding “each and every byte flowing out of your agent,” including non-HTTP protocols like the PostgreSQL wire protocol. This enables it to inspect and control actions even through complex tunnels.
HCL-based Rule System: Rules are defined using HCL (Terraform’s configuration language), stored in Git, and unit-tested against fixture requests. This provides highly granular control, allowing Deno’s 1000-line rule file to block specific database functions or actions even when tunneled.
Credential Injection: Claw Patrol securely holds and injects credentials (e.g., cookies, OAuth, AWS SigV4, database credentials), ensuring agents never directly access sensitive secrets.
Approval Workflows: Actions can be routed for approval by an LLM judge, a human (e.g., via Slack), or a combination, offering “very precise control” outside the agent software itself.
Observability Dashboard: A dashboard provides visibility into agent activity, denied requests, and actions awaiting approval, offering “utilitarian driven” insights.
Secure Networking: It integrates with secure network solutions like Tailscale and WireGuard, leveraging Tailscale for dashboard authentication, ensuring operations are “off the internet” and tightly controlled.

A demo illustrated Claw Patrol blocking a DROP TABLE users command issued by Codex (running in “yolo mode”) by intercepting and rejecting the destructive action at the Postgres wire protocol level.

Regarding future developments, while models are becoming smarter and more aligned, Dahl asserts that “we will never be able to fully trust AIs,” and “we’re always going to have to have backstop security mechanisms.” Claw Patrol represents Deno’s effort to implement this external security boundary.