Skip to main content

Setup for security engineers

Surface: SDK and Gateway (org-wide) Modes supported: Hosted Hybrid Local Tiers: Free Solo Teams

Who this is for​

You are accountable for what leaves the building. AI tools are a new egress path, and you need deterministic prevention on enforcing surfaces, explicit coverage on every event, and a complete audit trail.

What you typically want governed​

  • Secret and PII egress. API keys, tokens, SSNs, and card numbers must never leave in a tool call or prompt.
  • A shared policy across SDKs, the gateway, and coding assistants, with enforcement declared per event rather than inferred from the host.
  • Evidence. A durable, queryable trail of every decision that distinguishes “did not run” from “ran and found nothing.”

Which surface to install​

Author one policy and use the SDK in apps you control and the Gateway in front of apps you do not. Both scan tool arguments against built-in DLP patterns (AWS keys, GitHub tokens, SSNs, cards, and more) automatically. A block denies the call. Python SDK hooks on Claude Code and Gemini CLI can instead mask a match in place and let the call continue. On the coding-agent surfaces that cannot accept rewritten tool input -- Cursor, Kiro, Codex CLI, Antigravity -- a mask rule becomes a deny instead. The Gateway can mask, on both the request and the response path, but does neither by default: it detects. See Gateway for the switches.

pip install controlzero

Starter policy​

Allow normal LLM and tool use, but block secret/PII egress via a DLP rule. DLP block overrides a would-be allow, so this stops a leak even on an otherwise permissive policy:

version: '1'
settings:
  default_action: allow
  default_on_missing: deny
  default_on_tamper: quarantine
rules:
  - id: allow-llm
    allow: 'llm:generate'
    reason: 'LLM use is permitted; DLP below stops leaks regardless.'
dlp_rules:
  - id: block-internal-codes
    pattern: 'PROJ-[A-Z]{3}-\d{6}'
    category: custom
    action: block
    reason: 'Internal project codes must not leave the agent.'

Built-in DLP patterns are always active; the rule above adds a custom one. To build a broader DLP rule set in the dashboard, see Set up DLP rules.

What you'll see​

  • A DLP block lands in the Audit Log with decision: deny and a DLP_BLOCKED reason code, telling you exactly which pattern fired and on which call.
  • Each row declares coverage for that event. The capability matrix is derived from the SDK's own capability declarations; run controlzero coverage --json to export them for your installation (a bare controlzero coverage prints only a short per-host summary).
  • Each plan defines an audit log retention window -- 7 days on Free, 90 days on Solo, and 365 days on Teams -- which is plan policy and is not applied yet (see the note below: retention is an organization setting that defaults to 30 days today). Query, filter, and export the logs for reviews.
  • Roll out org-wide with observation-only first so you measure real egress attempts before you start blocking.
Audit retention is the configured window, not yet enforced deletion

Automatic deletion of audit records at the end of the window is not currently running on the production audit store, so audit records are kept longer than the window. Deletion will be switched on only after dated notice to affected organizations. When tiered audit retention takes effect, Free organizations created before then keep their existing 30-day window unless an owner changes it, and an owner can set a shorter window.

Next steps​