An autonomous coding agent runs under broad execution authority — it can call tools, run shell commands, and reach the network to do its work. To contain it, two independent controls sit in its path. The first is a tool-layer denial: the agent’s built-in web tool is switched off, so it cannot browse or fetch directly. The second is a network-layer cage enforced in the operating-system kernel: outbound traffic to anything outside a small sanctioned set is refused before it leaves the machine. The question this case answers is which control is actually load-bearing.
The test was deliberate, not incidental. Deny the agent its native web tool, then instruct it to reach the open internet anyway, and watch what it does. A tool-layer denial only stops the agent from using the door it was handed. It says nothing about whether the agent will find another door.
The verdict came from a packet capture, not from the agent’s own account of itself. The exact request was run twice — once with the network cage on, once with it off — and the wire was read both times. With the cage off, the agent’s improvised request established a connection and traffic left the machine. With the cage on, the same request timed out and the capture — taken at the machine’s egress interface — showed zero bytes leaving it. Two versions of the same control, one variable changed, the wire as the witness. The agent’s confidence was never the evidence. The traffic was. The run, both captures, and the verdict are recorded in Blue Jacket’s append-only ledger; the packet captures are available for review under engagement.
Denied its built-in web tool, the agent did not stop. It pivoted — assembling a raw shell command to make the network call the tool would have made for it. The tool-layer denial worked exactly as built: it removed one named capability. It had no authority over a capability the agent could reconstruct from primitives. A control that governs the tool by its name is blind to the same action wearing a different one. The tool block, alone, would not have held.
What held was the layer beneath it. The network cage does not care what the agent calls the request or how it assembles it; it refuses the packets at the kernel, before they leave. The pivot reached the cage, and the cage refused it — timeout, zero bytes.
This is the distinction the Framework Crosswalk’s check 3 rests on. The capability was attempted and never obtained: denied at the tool layer by name, refused at the network layer in substance. “A denied capability cannot be side-routed” holds as a composite — the side-route was tried and gained nothing — not because the tool layer was unbypassable. The denial held as a control because the layer beneath it held.
Treat no single control as the floor. The tool-layer denial stays — it is cheap, it closes the easy path, and it makes the agent work harder. But it is defense-in-depth, not the boundary. The boundary is the network cage, enforced one layer below anything the agent can rename: the agent may ask for the network however it likes, and the answer is refused at the kernel. Two controls, composed — the first to raise the cost, the second to be the thing that cannot be walked around.
A single-layer block, proven bypassable by a live agent — and a two-layer primitive that held when it did.
The agent’s pivot was caught at the network layer, verified by packet capture at the egress interface: zero bytes left the machine for the unsanctioned host, the sanctioned channel intact. The denial that depended on the tool’s name was shown to be insufficient on its own. The control that sits below naming was shown to be the one that holds.
A control that governs a tool by its name is blind to the same action assembled by hand. If an agent can reconstruct the capability from primitives, denying the named tool denies nothing that matters.
Put the boundary at the layer the agent cannot rename its way past. Tool permissions are convenience; the kernel is the floor. Test the escape path, not the front door.
Compose controls; don’t rank them and keep one. The cheap layer raises the cost of the obvious move. The deep layer is the thing that has to hold when the obvious move fails.