Content integrity at the server side layer

# ABOUTME: Kyverno policy requiring agent workloads to carry egress audit annotations.
# ABOUTME: Ensures what left the boundary is recorded outside the agent's reach.
#
# Evidence, not prevention. The EU AI Act Article 73 reporting clocks (2 days
# for serious disruption of critical infrastructure, 15 days generally, in
# force since 2 August 2026) are unmeetable without a record that survives the agent.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: agents-require-egress-audit
  annotations:
    policies.kyverno.io/title: Agent workloads must be egress-audited
    policies.kyverno.io/category: Content integrity
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      An agent that can be prompt-injected will eventually be prompt-injected.
      This policy does not prevent that. It requires that whatever the agent
      sent is recorded somewhere the agent cannot edit, so an incident has an
      evidence trail and a reporting clock can be met.
spec:
  validationFailureAction: Enforce
  background: true
  rules:

  - name: require-egress-audit-annotation
    match:
      any:
      - resources:
          kinds: [Pod]
          namespaces:
          - "agent-*"
    validate:
      message: >-
        Agent pods must declare an egress audit sink via the
        covenants.io/egress-audit-sink annotation. Exfiltration you cannot
        evidence is exfiltration you cannot report.
      pattern:
        metadata:
          annotations:
            covenants.io/egress-audit-sink: "?*"

  - name: audit-sink-must-be-external
    match:
      any:
      - resources:
          kinds: [Pod]
          namespaces:
          - "agent-*"
    validate:
      message: >-
        The egress audit sink must not resolve into the agent's own namespace.
        A log the agent can delete is not evidence.
      deny:
        conditions:
          any:
          - key: "{{ request.object.metadata.annotations.\"covenants.io/egress-audit-sink\" }}"
            operator: AnyIn
            value:
            - "*.agent-claude-prod.svc.cluster.local*"

# ABOUTME: Cilium egress policy bounding where an injected agent can send data.
# ABOUTME: The real anti-exfiltration control: injection succeeds, and has nowhere to post.
#
# This is the server-side answer to prompt injection, and it is not a content
# control. It does not detect the manipulation. It removes the payoff.
#
# Substitute the FQDNs for your own approved set. Every host listed here is a
# host an injected agent may exfiltrate to, so the list is a threat-model
# decision and belongs in the agent's charter, not in a platform default.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: agent-egress-exfiltration-bound
  namespace: agent-claude-prod
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: agent

  egress:

  # DNS is required for FQDN policy to function. Restricted to the cluster
  # resolver so the agent cannot use an external resolver as a covert channel.
  - toEndpoints:
    - matchLabels:
        io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: "53"
        protocol: UDP
      rules:
        dns:
        - matchPattern: "*"

  # Model API. The one destination the agent genuinely needs.
  - toFQDNs:
    - matchName: "api.anthropic.com"
    toPorts:
    - ports:
      - port: "443"
        protocol: TCP

  # Approved internal services, by FQDN rather than CIDR so the intent is
  # readable and so a re-IP does not silently widen the policy.
  - toFQDNs:
    - matchName: "artifacts.internal.example.com"
    toPorts:
    - ports:
      - port: "443"
        protocol: TCP

  # NOTE ON WHAT THIS DOES NOT STOP.
  #
  # Any allowlisted host is an exfiltration path if it accepts writes. If you
  # allow a code-hosting domain, a Gist is permitted traffic. Narrow by method
  # and path where the proxy supports it, and treat a write-capable allowlisted
  # host as a residual risk you have accepted rather than one you have closed.
  #
  # DNS tunnelling survives this policy. The matchPattern "*" above is required
  # for FQDN enforcement to work at all, and it is a covert channel. Detect it
  # at the resolver rather than pretending the policy closes it. See
  # sentinels/blast-radius/server-side/.