Why Your AI Agents Need a Security Firewall, Not a Prompt Guard

Ryan Dahl details Deno's internal incident-response agent system, which grants Opus agents rewrite access to production Postgres, Kubernetes, ClickHouse, AWS, and Slack. While Opus is well-aligned, prompt injection from external support systems makes agents fundamentally untrusted.

Dahl argues that security cannot rely on agent alignment or proxy-level HTTP guards. Instead, Deno built Claw Patrol, an open-source proxy that parses every byte of outbound traffic at the protocol level—including non-HTTP protocols like Postgres—and enforces granular rules written in HCL.

Claw Patrol supports credential injection (so agents never see secrets), a rule system with unit tests, and human-in-the-loop approval via Slack or an LLM judge. It runs over Tailscale/WireGuard, acting as a secure exit node for agent VMs.

The key tradeoff: this approach adds significant operational overhead. Teams must maintain a thousand-line HCL rule file, test fixtures, and manage credential stores. However, for production systems where agents can cause real damage, it may be the only viable approach.