Network controls

Capture and control workstation traffic to AI vendors, and limit which applications can reach AI services.

Requires the privileged service

The network guard runs in the privileged service and is off by default. To send provider calls through an LLM gateway, see Gateway routing.

Network guard

Enable it under Policy → Network guard. The service then runs a TLS proxy that decrypts only AI-vendor domains: the built-in Anthropic, OpenAI and ChatGPT, Google Gemini, Cursor, Copilot, Windsurf, and model API hosts, plus any Additional AI domains you list. It uses a per-device certificate authority whose key never leaves the device.

For each intercepted connection the guard:

captures the request and response, including streamed responses, up to 1 MiB per body by default, unless capture is disabled or collection is metadata only;
applies your ordered API rules: block, allow, or inject a header, each in enforce or monitor mode. Inject header is for vendor tenant restrictions such as anthropic-allowed-org-ids;
never records credential headers such as Authorization, API keys, or cookies.

All other traffic passes through without decryption and is recorded only as a flow. Captured exchanges and flows appear on a device's Network tab and are removed with the device.

How traffic reaches the guard

	Linux	macOS
Redirection	nftables redirects HTTPS to AI-domain addresses into the guard. QUIC to those addresses is rejected.	A Network Extension transparent proxy, deployed through MDM. Without it, an explicit proxy at 127.0.0.1:15480.
Process attribution	From the owning process of each socket.	From the Network Extension.
CA trust	Installed in the system trust store and exported for Node-based tools.	Delivered with an MDM certificate payload.

Explicit proxy coverage

In explicit proxy mode, only clients that use the proxy are covered. Tools that ignore proxy settings reach providers directly. Blocking those needs the Network Extension on macOS or the kernel gate on Linux.

Failure behavior

If the guard is down, redirected connections are refused. AI traffic fails closed; other traffic is untouched.
Clients that pin certificates, or do not trust the device CA, fail on AI domains. This is by design.
Clients that speak only HTTP/2 are served HTTP/1.1.

Limit which applications reach AI services

On the Network tab, What can access LLM services is either Any application or Allowed applications. It applies only while the network guard itself is enabled; gateway routing alone does not turn it on.

With Allowed applications, the guard answers AI-domain requests from processes outside a supervised run with a 403 that names the launcher, and the service refuses them gateway keys. On Linux, the kernel also refuses those connections. You can list executables that may connect anyway, by full path; a folder or .app bundle covers everything inside it. Listed applications do not receive gateway keys.