Back to Policy Packs
Web Fetch Access Policy
Pre-action governance for web fetch/HTTP requests. Enforces URL allowlists, blocked domains (data exfiltration endpoints), method restrictions, header controls, and rate limiting to prevent data leakage and unauthorized external communications.
v1.0.0
Requirements
Required Capabilities
web.fetch
Minimum Assurance Level
L0
Required Limits
allowed_domains
Enforcement Rules
These rules are automatically enforced when using this policy pack
domain_allowlist_enforced
blocked_domains_enforced
method_restrictions_enforced
header_restrictions_enforced
rate_limiting_enforced
Best Practices
- Use domain allowlists to restrict web requests to trusted domains only
- Block known data exfiltration domains (pastebin, file sharing services)
- Restrict HTTP methods (e.g., only allow GET/POST, block PUT/DELETE for read-only agents)
- Block sensitive headers that could leak credentials or tokens
- Implement rate limiting (requests per hour) to detect scanning/exfiltration
- Log all web requests with full URL and headers for audit trail
- Consider blocking requests to private IP ranges (localhost, 192.168.*, 10.*)
- Monitor request patterns for anomalies (e.g., 100s of requests to same domain)
- Subscribe to status webhooks for instant suspend on suspicious activity
- Use URL pattern matching to allow specific API endpoints only
- Audit logs should capture URL, method, response status, and timestamp