What's your approach to agent security at the network layer?

Most agent security focuses on sandboxing the execution environment: permissions, credentials outside the LLM flow, encrypted containers.

But what about watching what the agent actually does with its access? Even with perfect sandboxing, the agent can still make outbound requests that exfil data or hit endpoints it shouldn't.

I've been running a network layer firewall setup on my agents. Every request gets scanned for secrets before it leaves. Kill switch ready if something looks wrong. The agent can't see the firewall so it can't try to disable it.

Feels like this layer gets overlooked. Everyone talks about sandboxing but not network enforcement.

What are others doing here? Anyone else monitoring agent traffic in real time?