Set the rules centrally for every team and agent
The security team sets the rules once, and every team, pipeline and AI agent follows them. The rules sit on a baseline firewall that the others inherit, so no package manager setting or agent instruction has to be trusted.
How central rules work
1Put the rules everyone must follow on a baseline
One baseline per ecosystem holds them: malware blocking, the vulnerability threshold and your approved upstreams.
2Give each team its own firewall
Team, CI and agent firewalls name the baseline as their parent. Its rules apply to them from the first request.
3Change a rule once
A change on the baseline reaches every inheriting firewall within seconds. Nothing is copied or re-imported.
What teams can and cannot change
- Teams can be stricter
- A firewall adds its own rules on top of what it inherits. CI can block more than a developer laptop does.
- Teams cannot be looser
- An inherited rule cannot be deleted, edited or disabled on the firewall that inherits it.
- Exceptions need the owner of the rule
- An exception to a baseline rule needs permission on the team firewall and on the baseline. It is logged and can expire.
- It follows your organization
- A baseline can inherit from another one, for example organization, then division, then team.
{ "id": "npm-team-a", "ecosystem": "npm", "parentId": "npm-baseline", "rules": [], "exceptions": [], "upstreams": []}Questions
Can a team opt out of a baseline rule?
No. It can add an exception for one package or version, with permission from the firewall that owns the rule. The exception is in the audit log and can have an expiry date.
How do AI agents fit in?
Agents use the same package managers as developers. Give them a firewall that inherits the baseline and their own access token, and the log shows their installs.
Can the rules live in Git?
Yes. Every firewall is a JSON configuration. Keep it in Git, deploy it over the API and roll back to any earlier version.
More features
- Hold new releases until they have agedRelease delay
- Block malicious packagesMalware blocking
- Block versions with known vulnerabilitiesVulnerability blocking
- Resolve internal names from your own registryDependency confusion
- Block packages by licenseLicense enforcement
- Run image pulls through the same rulesContainer firewalling
Try it on one registry
Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.