AXQA Smart Agent Network Allowlist | Secure Local Execution

Smart Agent Network Allowlist & Step-Up Verification

Smart Agent uses a project-scoped, deny-by-default Network Allowlist that controls which network targets the Agent may access during local execution.
Only explicitly approved Hosts, URLs, IP addresses, or CIDR ranges are allowed, while sensitive network rules require additional security verification before activation.

Why it matters

Prevents Smart Agent from accessing arbitrary network targets.
Keeps local execution restricted to explicitly approved systems.
Applies stronger verification to high-risk network changes.
Provides traceability for Smart Agent security-policy changes.

When to use it

When enabling Smart Agent for a project.
When allowing access to a new internal API or host.
When restricting local execution to specific ports.
When reviewing sensitive local-network permissions.

Core concepts

Default Deny – Targets are blocked unless explicitly approved.
Host Rule – Allows a specific hostname.
URL Rule – Allows a specific URL target.
IP Rule – Allows a specific IP address.
CIDR Rule – Allows an approved network range.
Allowed Ports – Optional restriction defining which ports can be reached.
Dangerous Rule – Sensitive rule requiring additional verification.
Step-Up Verification – Additional password and OTP verification required for sensitive changes.

How it works

Each Project has a Smart Agent Network Policy.
The policy defaults to Deny.
An authorized administrator adds an approved target.
AXQA normalizes and validates the rule.
Normal safe rules can become active immediately.
Sensitive rules trigger Step-Up Verification.
The administrator verifies their password.
AXQA sends an OTP to the authorized user's email.
After OTP verification, the sensitive rule enters a delayed activation period.
The rule can be cancelled before activation.
Smart Agent retrieves and enforces the approved project policy locally.

How to use it

Step 1: Open Smart Agent Network Allowlist

Open:

Security → Smart Agent Network Allowlist

Select the Project whose local execution policy you want to manage.

Step 2: Add a rule

Choose one of:

Host
URL
IP
CIDR

Enter the target that Smart Agent should be allowed to access.

Step 3: Restrict ports when needed

Enter Allowed Ports when the target should be reachable only through specific ports.

Example:

443

or supported multiple-port configuration.

Restricting ports reduces unnecessary network exposure.

Step 4: Add a normal rule

When the rule is considered normal and safe by the security classifier, AXQA can activate it immediately.

The policy version is updated to reflect the configuration change.

Step 5: Complete Step-Up Verification for sensitive rules

Sensitive rules require additional verification.

The flow is:

Note

Password Verification
↓
Email OTP
↓
OTP Verification
↓
Pending Activation

Both verification steps must complete successfully.

Step 6: Review delayed activation

A sensitive rule does not become effective immediately.

After successful Step-Up Verification, AXQA applies a short delayed activation window.

During the current security flow, the delay is five minutes.

Step 7: Cancel a pending change

Before the delayed rule becomes effective, the pending change can be cancelled.

Use this when:

The rule was created incorrectly.
The network information changed.
The administrator determines that the access should not be granted.

Step 8: Understand permanently blocked targets

Some highly sensitive targets cannot be enabled even through Step-Up Verification.

Smart Agent permanently blocks protected infrastructure targets such as cloud metadata endpoints.

Best practices

Keep the default policy as Deny.
Add only targets required for the Project.
Restrict ports whenever possible.
Prefer specific IP or CIDR approval when accessing private/local network destinations.
Review pending sensitive rules before they activate.
Remove rules that are no longer required.

Common mistakes

❌ Assuming installation of Smart Agent gives access to the complete local network.
✔ Smart Agent follows the Project Network Allowlist.

❌ Creating broad network rules when only one service is required.
✔ Allow the narrowest practical host, IP, CIDR, and port scope.

❌ Assuming password verification alone activates a sensitive rule.
✔ Sensitive changes also require Email OTP verification.

❌ Assuming every sensitive destination can be approved.
✔ Some protected infrastructure targets remain permanently blocked.

Security & permissions

Network policy management validates project-level management authorization.
The primary Security management interface is restricted to administrative access.
Dangerous-rule password and OTP verification are rate-limited.
Sensitive rule changes generate security and policy audit events.
Administrators can receive email alerts for pending sensitive changes.
Sensitive rules activate only after successful Step-Up Verification and the configured delay.
Smart Agent validates the Network Allowlist before local network requests are performed.
Redirect destinations are revalidated rather than trusted automatically.

AXQA

Did You Know?