Securing Autonomous Agents with Claw Patrol

The Breakthrough

Ryan Dahl and the Deno team developed Claw Patrol, a protocol-aware proxy that treats autonomous agents as untrusted software by intercepting all outbound traffic below the HTTP layer to enforce security policies.

What Actually Worked

• Protocol-Level Interception: The proxy parses traffic at the wire protocol level, allowing it to block destructive commands (e.g., DROP TABLE) even when an agent spawns a subprocess like psql to tunnel through an EKS endpoint.
• HCL-Based Rule Engine: Security policies are defined in HashiCorp Configuration Language (HCL), managed in Git, and validated via a built-in unit testing framework that runs against fixture requests.
• Credential Injection: The proxy holds all production credentials (including AWS SigV4, OAuth, and cookies), ensuring the agent never has direct access to secrets and preventing credential leakage.
• Multi-Stage Approval: Rules can trigger automated verification via an LLM judge or require human intervention via Slack before an action is permitted to proceed.
• Network Isolation: The proxy functions as a Tailscale or WireGuard exit node, ensuring all agent traffic remains off the public internet and is authenticated via existing network identities.

Context

As Deno began using agents like Opus for incident response, they granted them write access to production systems including Postgres, Kubernetes, and AWS. Recognizing that prompt injection could bypass internal model alignment, the team concluded that security cannot rely on the agent's internal obedience. Claw Patrol was built to provide a hard security boundary that does not require modifications to the agent software itself.