New destinations wait for your approval
A first-seen hold per policy, not a global category.
The Greywall holds every name a policy has not resolved before. Approve it, block it, or let the hold expire by policy. The baseline belongs to the agent, not to the vendor.
The destination your agent reaches next did not exist when you wrote the policy
Blocklists describe the past. A compromised agent reaches for a domain registered this morning, a two-year-old storage bucket nobody approved, or a legitimate SaaS tenant that belongs to someone else. A global newly-seen category catches only the first. First-seen to this policy catches all three.
Global categories age into allow
Once a domain has been seen by the vendor for a while it is allowed everywhere. Your finance agent had no reason to reach it on day one or day thirty.
The agent is doing what it was told
Prompt injection, a poisoned tool description, a dependency that phones home. Intent is not the signal. A name this policy has never resolved is.
Review needs context
A hostname alone is not a decision. Which agent, how many times, since when, and how established the domain is.
Learn, hold, decide
Learn Only
Run the policy for one to two weeks. First-seen names are recorded with Greywall Event: New Query and nothing is held. This builds the baseline from real work.
Enforce with a hold
Switch Greywall Mode to Enforce and set the hold: short for chatty development agents, long for production agents that should never surprise you.
Approve, block, or forward
Decide in the console, through the API, or from a chat action driven by the webhooks. Every decision is a list entry with a source and an expiry.
Greywall controls
Baseline per policy
A destination approved for the research agent stays held for the finance agent. Identities bound to a policy share its baseline.
Hold time per policy
Seconds to weeks. The hold is a policy field, published like any other change and recorded in the change log.
Establishment rank
Every event carries the domain rank. A first-seen name with rank zero is a different review than a first-seen name in the top ten thousand.
Decisions become list entries
An approval is an allow list entry with a source and reference. A block is a block list entry with an optional expiry. Nothing is implicit.
Forwardable events
Held names are events like any other. Search first-seen by site in Splunk, Sentinel, Elastic or Datadog with the queries on the integrations pages.
MSSP inheritance
A parent block reaches every child tenant. A child approval never widens a parent block.
Two fields and a mode
The Greywall is greylist.mode and greylist.holdtime on the policy. Learn Only records; Enforce holds. Held and blocked names answer with the policy block page address, so a tool call fails in a way code can recognize.
PUT /api/v1/gateway/policies/{policy_guid}
{ "default": "deny", "greylist": { "mode": "enabled", "holdtime": 86400 } }| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 14:02:11 | accept | research-agent | api.openai.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:11 | accept | research-agent | api.tavily.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:14 | greywall | research-agent | cdn-assets-sync.top | 10.40.2.17 | first seen, held 24h |
| 2026-09-15 14:02:14 | block | research-agent | dns.google | 10.40.2.17 | category: DoH provider |
| 2026-09-15 14:02:19 | threat | research-agent | update-check.pw | 10.40.2.17 | feed: c2-indicators |
| 2026-09-15 14:02:31 | accept | finance-agent | api.stripe.com | 10.40.3.8 | allow list |
Questions teams ask
Is the baseline per policy, per site or per tenant?
Per policy. Sites and virtual sites bound to the same policy share its baseline.
Will this hold my agents to death?
Not if you learn first. Import the scope templates for the model provider and tools in use, run Learn Only, approve what the agent demonstrated it needs, then enforce. The review queue is exportable to the tool you triage in.
What happens when the hold expires?
The policy decides. With Default Action set to Deny the name stays blocked until approved. With Allow it resolves after the hold.
See the Greywall on your own traffic
Run one policy in Learn Only for a week and review the first-seen queue with your team.