The autonomy boundary
Governed internet access
No direct agent egress
The kern-agent operating-system user cannot connect directly to the internet. Agent HTTP and HTTPS clients point at Kern's local policy proxy, and nftables blocks off-host traffic that does not cross that boundary. A destination with no matching integration or custom-domain rule is denied before DNS resolution.
Four layers of control
| Layer | What it decides |
|---|---|
| Managed integration | Whether a known service such as OpenAI, Anthropic, GitHub, NPM, or Python packages is available and with which options. |
| Custom domain rule | Which additional hostname, HTTP methods, and optional path patterns an agent may reach. |
| Credential injection | Which policy-approved requests receive a provider credential; secrets remain outside agent-home. |
| Tool service | Which structured actions, accounts, schemas, and approval gates apply to bundled tools. |
Inspected HTTPS
Kern installs a host-local certificate authority for agent clients. The proxy terminates the agent-side TLS connection, validates the request against policy, resolves and validates the upstream address, then opens the allowed upstream connection. This is what lets Kern enforce host, method, path, header, body, and credential rules on HTTPS traffic.
Every decision is inspectable
When a request fails, check Network audit for the exact denial code. Widen only the smallest boundary the real request proves necessary: the specific integration, hostname, method, path, or repository.