No Proxy, No Fetch Tool: Capability-Scoped Internet Access for In-Cluster Agents
Introduction Say an agent running in your cluster or on a server needs to read the news. The obvious answer is to give it an HTTP client and let it fetch URLs, perhaps through an egress proxy for hygiene. The agent in question is an in-cluster assistant with meaningful access. It could query my Kubernetes cluster through a projected ServiceAccount token, control home automation, and reach several important internal services. Giving a system with such reach a general-purpose fetch(url) tool creates a simple problem: every page it reads becomes a potential instruction source, and every host on the internet becomes a potential destination for whatever it knows. ...