A machine-tool vendor's agent needs direct egress - how do you write that exception so an implant on the same host cannot live in it?

## Why the exception is a design problem A direct-egress exception for an unproxyable device is permanent, undocumented by default, and written under pressure. It is also the single most attractive object in the rule base to anything that lands on that machine, because a packet filter matches addresses and ports rather than programs: whatever the rule permits, it permits to every process on the host. The engineering question is not whether to write it - sometimes there is no alternative - but how much of it you can take back. ## Narrowing, axis by axis **Source.** One address, belonging to one device. A rule whose source is a subnet turns a single vendor's requirement into an estate-wide permission, and it is the most common shortcut precisely because it survives the device being re-addressed. **Destination.** The specific endpoints the vendor uses. This is the hardest axis and the one worth fighting for, because "any address, port 443" is functionally the same as no egress control at all for that host. Vendors relocate endpoints, so the rule needs a maintenance story: a written destination list from the vendor, a review when it breaks, and a preference for filtering on the server name in the handshake where the gateway can do it, since a name survives an address change. **Port and protocol.** One each. If the agent uses TCP/443, nothing else is permitted - not ICMP, not UDP, not a second port "in case". **Time.** If the agent checks in on a schedule, the rule can be open on that schedule. Many will not tolerate it; some will, and it removes most of the hours in which the exception is usable by anything else. **Provenance.** Name, owner, date, and the business dependency in one sentence. The rule base that nobody dares prune is a rule base whose entries never recorded why they exist. Writing that sentence is a two-minute cost at creation and the only thing that makes removal negotiable in three years. ## What you have actually given up Every other host in the estate produces a proxy record: the destination name requested, the policy verdict, the volume, often the user. This host produces none. What is left is flow telemetry and, sometimes, the handshake. A flow record carries the source and destination addresses, the source and destination ports, the protocol, byte and packet counts, and start and end timestamps. It carries no payload whatsoever. It establishes that two endpoints exchanged a measurable number of bytes at a time. It cannot tell you what was in them, which account was involved, or whether the transfer was the agent's telemetry or someone else's copy of a design file. The server name in the TLS ClientHello, where the agent connects by name and the handshake is visible, adds the intended destination name. It does not add contents. Both are directional claims worth stating carefully in an interview: flow proves movement, the handshake proves intent to reach a name, and neither proves what moved. ## Monitoring built from what remains Given those records, the alerts that can honestly be written are about shape rather than content: - **Destination novelty.** This source has a tiny, stable destination set. Anything new from it is worth a look, and it is the single highest-value alert available on a bypassed host. - **Schedule deviation.** A diagnostic agent that checks in every fifteen minutes has a rhythm. Sessions at hours it does not normally run are cheap to detect. - **Volume against its own baseline.** Not against a global threshold - against what that device has done for the last ninety days. A telemetry uploader that suddenly moves two orders of magnitude more is a question worth asking, and asking it is all you can do, because the records will never tell you what the bytes were. Note what none of this delivers: certainty. The exception buys the plant its vendor support and costs you the ability to answer "what left?" for one machine. Saying that plainly, and showing the compensating watch you built, is the answer an interviewer is looking for. ## The pressure to write it badly The wide version - source subnet, any destination, TCP/443, permanent, unnamed - takes thirty seconds and never breaks. The narrow version takes a conversation with a vendor, a change record, and a rule that will need maintenance when the vendor moves an endpoint. The narrow version is also the only one that stops the exception being a general-purpose exit for anything running on that floor. Being able to describe that trade, and to say which parts you would concede first when the line is down, is the senior part of the answer.