The useful lesson here is that running open weights locally removes the provider from the loop, but not the need to fence the runtime. Weights on their own only produce text; any network call has to go through a tool, plugin or harness that someone handed the model, so that grant is the boundary worth auditing. Default-deny egress on the box running inference, plus logging every tool call, is what turns "it tried" into "it couldn't, and we saw it." Has anyone here actually set up per-tool network rules for a local agent stack, rather than just a firewall on the whole host?
The useful lesson here is that running open weights locally removes the provider from the loop, but not the need to fence the runtime. Weights on their own only produce text; any network call has to go through a tool, plugin or harness that someone handed the model, so that grant is the boundary worth auditing. Default-deny egress on the box running inference, plus logging every tool call, is what turns "it tried" into "it couldn't, and we saw it." Has anyone here actually set up per-tool network rules for a local agent stack, rather than just a firewall on the whole host?