Keep data inside
Egress is allowlisted, personal data is redacted, and every outbound call is a gated act./Your data only goes where you said it can go.
An agent with capability is not an agent with authority. HVT treats every outbound request as a consequential action that must clear the Verify and Policy gates./An agent that can send data is not allowed to send data. Every message leaving your systems has to pass a check first.
What goes wrong without it
Hostile instructions hidden in documents steer an agent into exfiltration./A trick buried in a file tells the agent to email your data away.
Personal data enters prompts and outputs without redaction./Names and ID numbers slip into prompts and answers.
Destinations are discovered at runtime instead of declared in advance./Nobody knows where the agent is sending things until after it happens.
Four steps, in order
Declare destinations
Approved external endpoints are written into an egress allowlist./You list the places data may go.
Verify evidence
Requests below evidence level L2 are rejected at Gate 03./Unproven requests are stopped at the door.
Redact
Personal data is redacted before the model sees it and before output leaves./Sensitive details are blanked out on the way in and on the way out.
Record
Each decision is sealed in a hash-chained evidence record./Every yes and no is written down in a log nobody can quietly edit.
Key capabilities
Egress allowlist
Unknown destination equals deny./Not on the list? Blocked.
PII redaction
Redaction runs at both the prompt and output boundary./Private details are hidden both ways.
Injection screening
The Verify gate treats retrieved content as untrusted input./Text from outside is never trusted as an instruction.
On-premise models
Open-weight models run on customer-controlled hardware./The AI runs on your machines, not someone else's cloud.
Before and after
A support agent is told by a poisoned ticket to send a customer file to an unknown host./A booby-trapped ticket makes the agent upload a customer file to a stranger.
Policy denies at the egress rule, the attempt is logged at evidence level L1, and an alert is raised./The upload is blocked, written to the log, and your team is told.
Illustrative scenarios. Controls shown are design intent, confirmed by the gates on your own infrastructure.
Related
See it on your own agents.
Architecture by Salem Salah bin Omair AlShamsi. Delivered with our technology partner.