Skip to main content

Setup for security engineers

Surface: SDK and Gateway (org-wide) Modes supported: Hosted Hybrid Local Tiers: Free Solo Teams

Who this is for​

You are accountable for what leaves the building. AI tools are a new egress path, and you need deterministic prevention on enforcing surfaces, explicit coverage on every event, and a complete audit trail.

What you typically want governed​

  • Secret and PII egress. API keys, tokens, SSNs, and card numbers must never leave in a tool call or prompt.
  • A shared policy across SDKs, the gateway, and coding assistants, with enforcement declared per event rather than inferred from the host.
  • Evidence. A durable, queryable trail of every decision that distinguishes “did not run” from “ran and found nothing.”

Which surface to install​

Author one policy and use the SDK in apps you control and the Gateway in front of apps you do not. Both scan tool arguments against built-in DLP patterns (AWS keys, GitHub tokens, SSNs, cards, and more) automatically. A block denies the call. Python SDK hooks on Claude Code and Gemini CLI can instead mask a match in place and let the call continue. On the coding-agent surfaces that cannot accept rewritten tool input -- Cursor, Kiro, Codex CLI, Antigravity -- a mask rule becomes a deny instead. The Gateway can mask, on both the request and the response path, but does neither by default: it detects. See Gateway for the switches.

pip install controlzero

Starter policy​

Allow normal LLM and tool use, but block secret/PII egress via a DLP rule. DLP block overrides a would-be allow, so this stops a leak even on an otherwise permissive policy:

version: '1'
settings:
  default_action: allow
  default_on_missing: deny
  default_on_tamper: quarantine
rules:
  - id: allow-llm
    allow: 'llm:generate'
    reason: 'LLM use is permitted; DLP below stops leaks regardless.'
dlp_rules:
  - id: block-internal-codes
    pattern: 'PROJ-[A-Z]{3}-\d{6}'
    category: custom
    action: block
    reason: 'Internal project codes must not leave the agent.'

Built-in DLP patterns are always active; the rule above adds a custom one. To build a broader DLP rule set in the dashboard, see Set up DLP rules.

What you'll see​

  • A DLP block lands in the Audit Log with decision: deny and a DLP_BLOCKED reason code, telling you exactly which pattern fired and on which call.
  • Each row declares coverage for that event. The capability matrix is derived from the SDK's own capability declarations; run controlzero coverage --json to export them for your installation (a bare controlzero coverage prints only a short per-host summary).
  • Audit logs are retained by tier -- 7 days on Free, 90 days on Solo, and 365 days on Teams. Query, filter, and export them for reviews.
  • Roll out org-wide with observation-only first so you measure real egress attempts before you start blocking.

Next steps​