Today's security stack wasn't built for agents. Dtwo was.

package egress.customer_financial_boundary
 
default allow := false
 
allow if {
    not financial_data_leaving
}
 
# classified records bound for an external destination
financial_data_leaving if {
    some record in input.context.payload.records
    record.classification == "customer_financial"
    not internal_destination
}
 
internal_destination if {
    some domain in data.org.trusted_domains
    endswith(lower(input.resource.uri), domain)
}

package payments.ingress.finance_only
 
default allow := false
 
claims := input.subject.claims
 
# Finance team only; other tools pass through.
allow if not is_payment_call
 
allow if {
    is_payment_call
    "finance" in object.get(claims, "groups", [])
}
 
is_payment_call if {
    startswith(lower(input.resource.name), "payments-")
}
 
reason := "Payment tools are Finance-only." if not allow

package email.ingress.block_external_after_financial
 
default allow := true
 
# Set by a companion policy on financial reads.
financial_seen if {
    some writes in input.context.session.policies
    writes["marker:finance:accessed"]
}
 
# Block outbound email after financial reads.
allow := false if {
    startswith(lower(input.resource.name), "email-")
    financial_seen
    some to in input.payload.args.to
    not endswith(lower(to), "@dtwo.ai")
}
 
reason := "Financial read; email blocked." if not allow