Pipelock Agent Egress Control: the missing CI primitive for AI agents

Runtime Egress Enforcement for Autonomous CI Agents: Kernel Isolation and Signed Auditing

Current Situation Analysis

Modern CI/CD pipelines are increasingly delegating tasks to autonomous agents. These agents perform issue triage, release automation, documentation generation, and security remediation. Unlike traditional scripted jobs, agents make dynamic decisions, interact with package registries, access cloud APIs, and traverse the public internet. This autonomy introduces a critical security gap: the network boundary.

Standard CI logs provide a narrative of what an agent claims to have done, but they offer no cryptographic proof of network behavior. An agent process can manipulate its own logs, suppress error messages, or exfiltrate data through channels that leave no trace in the job output. Security teams lack a primitive to enforce egress policies at the kernel level and generate tamper-evident evidence of network activity.

The industry has relied on static analysis for code changes and manual review for agent behavior, but runtime network enforcement remains underdeveloped. Without a hard boundary, agents operate with implicit trust, creating risks of credential leakage, unauthorized API calls, and data exfiltration. The release of pipelock-agent-egress-action v0.1.0 (2026-05-09, Apache 2.0) addresses this by introducing kernel-level isolation and signed auditing as a CI primitive. This approach shifts the trust model from agent-generated logs to boundary-enforced receipts, enabling verifiable security reviews for autonomous workflows.

WOW Moment: Key Findings

The following comparison highlights the operational and security differences between standard agent execution and Pipelock-enforced egress control. The data reflects the architectural guarantees provided by kernel-level namespace isolation and cryptographic receipt chains.

Approach	Network Visibility	Trust Model	Exfiltration Risk	Audit Integrity
Standard CI Agent	Log-based; agent-controlled	Agent-signed or unverified	High; direct socket access	Low; logs can be altered
Pipelock Enforced	Kernel-level receipts; boundary-signed	Third-party verifiable via pinned key	Near-zero; iptables enforcement	High; signed receipt chain

Why this matters: The shift to boundary-signed receipts enables offline verification of agent behavior without trusting the agent itself. Security reviewers can validate that all network activity conformed to policy, and any deviation is cryptographically detectable. This reduces the attack surface for autonomous workflows and provides a defensible audit trail for compliance.

Core Solution

Implementing egress control requires establishing a hard network boundary, enforcing non-root execution, and generating verifiable evidence. The solution leverages Linux network namespaces and iptables to isolate the agent process, routing all traffic through a proxy that enforces policy and signs receipts.

Step 1: Environment Provisioning

Install the Pipelock binary and verify its integrity. This step ensures the enforcement tool is authentic and matches the expected version.

- name: Provision Pipelock Binary
  run: |
    BINARY_URL="https://github.com/luckyPipewrench/pipelock/releases/download/v2.4.0/pipelock_2.4.0_linux_amd64.tar.gz"
    CHECKSUM_URL="https://github.com/luckyPipewrench/pipelock/releases/download/v2.4.0/checksums.txt"
    
    curl -fsSLO "$BINARY_URL"
    curl -fsSLO "$CHECKSUM_URL"
    
    grep 'pipelock_2.4.0_linux_amd64.tar.gz' checksums.txt | sha256sum -c -
    tar -xzf pipelock_2.4.0_linux_amd64.tar.gz
    sudo install -m 0755 pipelock /usr/local/bin/pipelock
    rm -f pipelock_2.4.0_linux_amd64.tar.gz checksums.txt

Step 2: Policy Configuration

Define egress rules in a YAML configuration file. This policy dictates allowed destinations, methods, and scanning behavior.

# security/policies/agent-egress.yaml
version: "1.0"
egress:
  - destination: "api.github.com"
    methods: ["GET", "POST"]
    scan: true
  - destination: "registry.npmjs.org"
    methods: ["GET"]
    scan: false
  - destination: "docs.example.com"
    methods: ["GET", "POST"]
    scan: true
    websocket:
      enabled: true
      frame_scan: true
      proxy_path: "/ws?url="
default_deny: true
dns_resolution: "proxy_only"

Step 3: Execution with Isolation

Run the agent script within the enforced namespace. The action creates a network namespace, applies iptables rules to block direct network access, and routes traffic through Pipelock. The agent runs as a non-root user with dropped capabilities.

- name: Execute Agent Under Egress Control
  uses: luckyPipewrench/pipelock-agent-egress-action@v0.1.0
  with:
    agent-script: ./scripts/run-triage.sh
    enforcement-binary: /usr/local/bin/pipelock
    policy-config: security/policies/agent-egress.yaml
    evidence-output: ./audit-artifacts
  env:
    AGENT_TOKEN: ${{ secrets.AGENT_

**Architecture Rationale:**
- **Network Namespace:** Provides a hard boundary. Direct socket calls, DNS queries, and raw TCP are blocked by `iptables` rules applied within the namespace.
- **Non-Root Execution:** The agent runs as `pipelock-agent` and the proxy as `pipelock-host`. Both users lack `sudo` privileges and have capabilities dropped, reducing the impact of a compromise.
- **Loopback Binding:** The proxy binds exclusively to the loopback interface, preventing external access to the enforcement point.
- **Signed Receipts:** Pipelock signs network receipts at the boundary. The agent never signs anything, ensuring receipts cannot be forged by a compromised process.

#### Step 4: Evidence Verification

After execution, verify the Audit Packet using a pinned public key. This step confirms the receipt chain is valid and the policy was enforced.

```bash
#!/bin/bash
# verify-audit.sh
AUDIT_DIR="./audit-artifacts"
PUBLIC_KEY="./keys/pipelock-ci-pub.pem"

pipelock verify \
  --receipt-chain "$AUDIT_DIR/receipts.json" \
  --policy-hash "$AUDIT_DIR/policy-hash.txt" \
  --public-key "$PUBLIC_KEY" \
  --output "$AUDIT_DIR/verification-report.json"

if [ $? -eq 0 ]; then
  echo "Audit verification successful."
else
  echo "Audit verification failed. Review $AUDIT_DIR/verification-report.json"
  exit 1
fi

name: Secure Agent Workflow
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  agent-triage:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Provision Pipelock Binary
        run: |
          curl -fsSLO https://github.com/luckyPipewrench/pipelock/releases/download/v2.4.0/pipelock_2.4.0_linux_amd64.tar.gz
          curl -fsSLO https://github.com/luckyPipewrench/pipelock/releases/download/v2.4.0/checksums.txt
          grep 'pipelock_2.4.0_linux_amd64.tar.gz' checksums.txt | sha256sum -c -
          tar -xzf pipelock_2.4.0_linux_amd64.tar.gz
          sudo install -m 0755 pipelock /usr/local/bin/pipelock
          rm -f pipelock_2.4.0_linux_amd64.tar.gz checksums.txt

      - name: Execute Agent Under Egress Control
        uses: luckyPipewrench/pipelock-agent-egress-action@v0.1.0
        with:
          agent-script: ./scripts/agent-triage.sh
          enforcement-binary: /usr/local/bin/pipelock
          policy-config: security/policies/agent-egress.yaml
          evidence-output: ./audit-artifacts
        env:
          AGENT_TOKEN: ${{ secrets.AGENT_SERVICE_TOKEN }}

      - name: Verify Audit Packet
        run: |
          pipelock verify \
            --receipt-chain ./audit-artifacts/receipts.json \
            --policy-hash ./audit-artifacts/policy-hash.txt \
            --public-key ./keys/pipelock-ci-pub.pem \
            --output ./audit-artifacts/verification-report.json
          if [ $? -ne 0 ]; then
            echo "Audit verification failed."
            exit 1
          fi

      - name: Upload Audit Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: audit-packet
          path: ./audit-artifacts