From 2bf303d13a694aa0278b4c2f74e4e0f2c9039fde Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 16:31:42 +0000 Subject: [PATCH 1/2] docs: Document factory network controls Cover factory and agent scoping, deny precedence, versioned built-in policies, catalog API, and pending Kubernetes support. Co-Authored-By: Oz --- .../docs/factories/factory-as-code.mdx | 89 +++++++++++++++++++ .../factories/infrastructure-and-security.mdx | 4 + 2 files changed, 93 insertions(+) diff --git a/src/content/docs/factories/factory-as-code.mdx b/src/content/docs/factories/factory-as-code.mdx index 41aa71e62..2d6768fdf 100644 --- a/src/content/docs/factories/factory-as-code.mdx +++ b/src/content/docs/factories/factory-as-code.mdx @@ -194,6 +194,94 @@ Repository substitutions for benchmark starting states. Each entry requires `sou **Optional.** Names of [managed secrets](/factories/secrets/) granted to every agent, in addition to secrets declared by an agent. +### `networkPolicy` + +**Optional.** +Restricts outbound network access for factory runs. Declare `networkPolicy` at the root of `factory.yaml` for every factory agent, or in an agent's frontmatter for that agent. It isn't an `agentDefaults` field or an automation override. + +If neither scope declares a policy, outbound access is unrestricted. Once either scope declares a policy, hosts not allowed by the combined policy are blocked, except for services required for the platform to function. + +```yaml title="factory.yaml" +schemaVersion: v1alpha1 +name: payments-factory +repositories: + - owner: acme + name: payments-service +agentDefaults: + model: auto +networkPolicy: + extends: warp/package-registries@1.0.0 + allowedHosts: + - api.example.com + deniedHosts: + - blocked.example.com +``` + +| Field under `networkPolicy` | Description | +| --- | --- | +| `allowedHosts` | Optional list of hostnames or literal IP addresses to allow. | +| `deniedHosts` | Optional list of hostnames or literal IP addresses to remove from user-configured allowances at either scope, including built-in policies. | +| `extends` | Optional built-in policy reference, or list of references, in the form `@`. | + +Host entries don't accept URLs, ports, CIDRs, or wildcards. Hostnames are normalized to lowercase. + +An omitted or `null` policy contributes no restrictions at that scope. An empty policy (`networkPolicy: {}`) enables restrictions but contributes no allowed hosts; allowances from the other scope still apply. If neither scope contributes allowed hosts, only required platform services remain reachable. A policy containing only `deniedHosts` is not an unrestricted-access denylist. + +#### Factory and agent scope + +Factory and agent allowances combine; the agent policy doesn't replace the factory policy. A denial at either scope takes precedence over an allowance at either scope, including hosts supplied by `extends`. + +For example, this agent adds access to a documentation service but cannot re-allow the host denied in `factory.yaml` above: + +```markdown title="agents/reviewer/agent.md" +--- +agentType: REVIEW +networkPolicy: + allowedHosts: + - docs.example.com + - blocked.example.com +--- + +Review pull requests against the service documentation. +``` + +Policies cannot block services required for the platform to function, even through `deniedHosts`. Warp adds the required access for the run, including its repository forges, configured MCP servers, image registry, and agent data storage. + +#### Built-in policies and versions + +Built-in policies supply reusable allowed-host lists: + +| Policy name | Purpose | +| --- | --- | +| `warp/claude-code` | Inference and authentication services for Claude Code. | +| `warp/codex` | Inference and authentication services for Codex. | +| `warp/package-registries` | Package registries and source or release downloads used by development toolchains. | + +Use an exact version such as `warp/package-registries@1.0.0` to pin the policy. A semantic-version range such as `warp/claude-code@^1` selects the highest matching version; `warp/codex@latest` selects the highest stable version. + +To combine policies, use a list: + +```yaml +networkPolicy: + extends: + - warp/package-registries@1.0.0 + - warp/claude-code@^1 +``` + +Query `GET /api/v1/networking/policies` on the {VARS.WARP_PLATFORM_API} for available policy names and versions. Authenticate with a [Warp API key](https://docs.warp.dev/agents/cli/oz-cli/api-keys/) stored in `WARP_API_KEY`: + +```bash +curl --fail --silent --show-error \ + https://app.warp.dev/api/v1/networking/policies \ + --header "Authorization: Bearer $WARP_API_KEY" +``` + +The response groups policies by `name`, with `latest_version` and a `versions` list. Each version includes `version`, `is_latest`, and `allowed_hosts`. The catalog excludes the platform's required-service allowances. + +#### Kubernetes support + +Network controls for the self-hosted Kubernetes backend are pending. Don't rely on `networkPolicy` to restrict Kubernetes task pods. + ### `mcpServers` **Optional.** @@ -402,6 +490,7 @@ All frontmatter keys are optional. | [`agentType`](#agenttype) | The agent's role. | | `credentialStrategy` | Overrides the factory-level [`credentialStrategy`](#credentialstrategy). Omit it to keep the agent's current setting. | | `spawnableBy` | Agents allowed to start this agent. Omit it to allow only the foreman, use an empty list to allow none, or list exact agent names. | +| `networkPolicy` | Combines with the factory's [`networkPolicy`](#networkpolicy); denials at either scope take precedence over user-configured allowances. | | `model`, `harness` | Override the corresponding [`agentDefaults`](#agentdefaults). Set at most one. | | `runner`, `environmentId`, `secrets`, `mcpServers`, `workerHost`, `computerUseModel` | Override the corresponding [`agentDefaults`](#agentdefaults), subject to each field's inheritance rules. | | `idleTimeoutMinutes` | Keeps a completed session available for follow-up for 1 through 60 minutes. Omit it or use `null` to inherit. Without an inherited or run-level value, Warp uses 10 minutes, or 60 minutes for an orchestrated child run. | diff --git a/src/content/docs/factories/infrastructure-and-security.mdx b/src/content/docs/factories/infrastructure-and-security.mdx index d9d4903a0..88b5abad1 100644 --- a/src/content/docs/factories/infrastructure-and-security.mdx +++ b/src/content/docs/factories/infrastructure-and-security.mdx @@ -31,6 +31,10 @@ With managed self-hosting, repository checkouts, commands, and sandbox files sta ![Self-hosted data security and boundaries diagram showing what stays in customer infrastructure, what Warp retains, and what transits Warp to model providers](../../../assets/agent-platform/data-security-boundaries.png) +## Network controls + +Restrict outbound access with [`networkPolicy` in the factory definition](/factories/factory-as-code/#networkpolicy). The reference covers factory and agent scope, deny precedence, built-in policies, and pending Kubernetes support. + ## Runners A runner selects the operating system, architecture, sandbox image, and vCPU and memory shape. The factory's [definition](/factories/factory-as-code/) supplies repositories, setup commands, and secrets. The factory definition sets the default runner with `agentDefaults.runner`. Individual agents and automations can override that default. From 22d154d77d9405353a2e8e234dd3d5af05fe3e90 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 17:58:30 +0000 Subject: [PATCH 2/2] docs: Clarify deny-all network policy configuration Apply review feedback on scope wording and reuse the general API authentication reference. Co-Authored-By: Oz --- .../docs/factories/factory-as-code.mdx | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/src/content/docs/factories/factory-as-code.mdx b/src/content/docs/factories/factory-as-code.mdx index 2d6768fdf..89e56acfe 100644 --- a/src/content/docs/factories/factory-as-code.mdx +++ b/src/content/docs/factories/factory-as-code.mdx @@ -197,7 +197,7 @@ Names of [managed secrets](/factories/secrets/) granted to every agent, in addit ### `networkPolicy` **Optional.** -Restricts outbound network access for factory runs. Declare `networkPolicy` at the root of `factory.yaml` for every factory agent, or in an agent's frontmatter for that agent. It isn't an `agentDefaults` field or an automation override. +Restricts outbound network access for factory runs. Declare `networkPolicy` at the root of `factory.yaml` for every factory agent, or in an agent's frontmatter for that agent. If neither scope declares a policy, outbound access is unrestricted. Once either scope declares a policy, hosts not allowed by the combined policy are blocked, except for services required for the platform to function. @@ -225,7 +225,7 @@ networkPolicy: Host entries don't accept URLs, ports, CIDRs, or wildcards. Hostnames are normalized to lowercase. -An omitted or `null` policy contributes no restrictions at that scope. An empty policy (`networkPolicy: {}`) enables restrictions but contributes no allowed hosts; allowances from the other scope still apply. If neither scope contributes allowed hosts, only required platform services remain reachable. A policy containing only `deniedHosts` is not an unrestricted-access denylist. +An omitted or `null` policy contributes no restrictions at that scope. A policy containing only `deniedHosts` is not an unrestricted-access denylist. #### Factory and agent scope @@ -247,6 +247,16 @@ Review pull requests against the service documentation. Policies cannot block services required for the platform to function, even through `deniedHosts`. Warp adds the required access for the run, including its repository forges, configured MCP servers, image registry, and agent data storage. +#### Denying all outbound access + +To deny all outbound network access except required platform services, set an empty policy in `factory.yaml` and remove any `allowedHosts` or `extends` from agent policies: + +```yaml title="factory.yaml" +networkPolicy: {} +``` + +An empty policy contributes no allowed hosts. Allowances from the other scope still apply, so an empty agent policy does not cancel factory allowances. + #### Built-in policies and versions Built-in policies supply reusable allowed-host lists: @@ -268,12 +278,10 @@ networkPolicy: - warp/claude-code@^1 ``` -Query `GET /api/v1/networking/policies` on the {VARS.WARP_PLATFORM_API} for available policy names and versions. Authenticate with a [Warp API key](https://docs.warp.dev/agents/cli/oz-cli/api-keys/) stored in `WARP_API_KEY`: +Query `GET /api/v1/networking/policies` on the {VARS.WARP_PLATFORM_API} for available policy names and versions. For authentication, see the [API reference](https://docs.warp.dev/api). -```bash -curl --fail --silent --show-error \ - https://app.warp.dev/api/v1/networking/policies \ - --header "Authorization: Bearer $WARP_API_KEY" +```http +GET https://app.warp.dev/api/v1/networking/policies ``` The response groups policies by `name`, with `latest_version` and a `versions` list. Each version includes `version`, `is_latest`, and `allowed_hosts`. The catalog excludes the platform's required-service allowances.