Traffic Policy Security

Define per-agent request rules using CEL expressions. Deny suspicious requests, rate-limit by IP, inject headers, and strip sensitive data — all evaluated in real time on the server before requests reach the agent. No agent restarts needed.

How It Works

Policies sit in the server's middleware chain, after authentication and before dispatch. Rules fire top-to-bottom; each rule has one or more CEL expressions (all must match) and one or more actions that execute in order. The first terminal action (deny or forward) stops further evaluation.

HTTP Request ──► Auth ──► Traffic Policy Engine ──► Dispatch ──► Agent
                              │
                         ┌────┴────┐
                         │ Rule 1  │  expressions[] + actions[]
                         ├─────────┤
                         │ Rule 2  │  expressions[] + actions[]
                         ├─────────┤
                         │ Rule N  │  ...
                         └─────────┘

CEL Variables

Every rule expression has access to these variables:

Actions

Policy Format

{
  "id": "my-agent",
  "rules": [
    {
      "expressions": [
        "req_method == 'DELETE'",
        "req_path.startsWith('/api/')"
      ],
      "actions": [
        {"type": "deny", "config": {"status_code": 403, "body": "DELETE not allowed"}}
      ]
    },
    {
      "expressions": ["req_path.startsWith('/api/')"],
      "actions": [
        {"type": "rate-limit", "config": {
          "key": "conn_client_ip",
          "rate": 10,
          "burst": 20
        }},
        {"type": "add-headers", "config": {
          "headers": {"X-Forwarded-For": "conn_client_ip"}
        }}
      ]
    }
  ]
}

API Endpoints

Manage policies via the admin API (port :8081):

Examples

Block all DELETE requests

curl -X PUT https://nfltr.xyz:8081/api/v1/policies/my-agent \
  -H "Content-Type: application/json" \
  -d '{
    "id": "my-agent",
    "rules": [{
      "expressions": ["req_method == '\''DELETE'\''"],
      "actions": [{"type": "deny", "config": {"status_code": 403, "body": "Forbidden"}}]
    }]
  }'

Rate-limit API by client IP

curl -X PUT https://nfltr.xyz:8081/api/v1/policies/my-agent \
  -H "Content-Type: application/json" \
  -d '{
    "id": "my-agent",
    "rules": [{
      "expressions": ["req_path.startsWith('\''/api/'\'')"],
      "actions": [{"type": "rate-limit", "config": {
        "key": "conn_client_ip", "rate": 10, "burst": 20
      }}]
    }]
  }'

Strip sensitive headers

curl -X PUT https://nfltr.xyz:8081/api/v1/policies/my-agent \
  -H "Content-Type: application/json" \
  -d '{
    "id": "my-agent",
    "rules": [{
      "expressions": ["true"],
      "actions": [{"type": "remove-headers", "config": {
        "headers": ["X-Internal-Token", "X-Debug-Info"]
      }}]
    }]
  }'