A network control that restricts where outbound traffic from a workload can go. For SSRF, it is one of the few controls that can stop a forged request from reaching metadata endpoints, internal services, or other sensitive destinations after validation fails.
Expanded Definition
Egress filtering is the enforcement layer that decides which outbound destinations a workload may reach, which protocols it may use, and in some environments which ports or DNS paths are permitted. In NHI security, it is most effective when treated as a control on the workload’s actual network path, not just as a perimeter rule. That distinction matters because service accounts, API-backed jobs, and AI agents can still be tricked into making requests that appear legitimate unless outbound movement is constrained.
Definitions vary across vendors, but the security objective is consistent: reduce the chance that a compromised workload can call internal metadata services, exfiltrate secrets, or pivot to adjacent systems after an SSRF or token theft event. This is closely aligned with the least-privilege direction in the NIST Cybersecurity Framework 2.0, especially where network communications must be controlled as part of protective architecture. The most common misapplication is treating egress filtering as a generic firewall setting, which occurs when teams allow broad outbound access for convenience and never scope rules to the workload, identity, and destination.
Examples and Use Cases
Implementing egress filtering rigorously often introduces operational friction, requiring organisations to weigh rapid service integration against tighter control over outbound reachability.
- A containerised microservice is allowed to call only its payment gateway and logging endpoint, preventing a compromised pod from scanning internal subnets.
- An AI agent with tool access is restricted to approved SaaS APIs so a prompt injection event cannot redirect it to arbitrary internet destinations.
- A build job can reach package registries and artifact stores, but not cloud instance metadata services, which limits credential theft during pipeline compromise.
- A legacy service account that still needs broad outbound access is placed behind monitored proxy rules while the team phases in narrower destination allowlists.
- When SSRF testing reveals a path to internal services, the workload’s outbound policy is tightened so validation failures cannot become internal requests.
For broader NHI context on why outbound containment matters, see Ultimate Guide to NHIs. For the network-control framing that supports this type of restriction, the NIST Cybersecurity Framework 2.0 is the clearest external baseline among the sources provided.
Why It Matters in NHI Security
Egress filtering is one of the few practical controls that can limit what a compromised non-human identity can do after initial abuse, especially when the abuse begins with stolen secrets, SSRF, or an overly permissive automation account. Without it, a single workload compromise can become a path to metadata services, internal control planes, or external exfiltration destinations. That is why it is so often paired with secret hygiene, workload identity scoping, and Zero Trust-style segmentation in NHI programs.
The NHI Management Group notes that Ultimate Guide to NHIs reports that 97% of NHIs carry excessive privileges, a condition that makes outbound restrictions even more important because over-entitled identities are harder to contain once misused. Egress control does not replace identity governance, but it can meaningfully reduce blast radius while teams improve entitlement design and key rotation. Practitioners usually encounter the need for this control only after a workload begins calling unexpected destinations, at which point egress filtering becomes operationally unavoidable to contain the incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, CSA MAESTRO and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 | Covers outbound restriction patterns that limit abused workload reach. |
| NIST CSF 2.0 | PR.AC-3 | Network access control supports least-privilege communications for workloads. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust segmentation includes restricting communications paths and exposure. |
| CSA MAESTRO | Agentic systems need constrained tool and network reach to reduce abuse. | |
| OWASP Agentic AI Top 10 | Agent prompt or tool abuse can turn into unsafe external calls without egress limits. |
Apply destination allowlists and review outbound permissions as part of protective access governance.
