Google’s AX Takes a Port in Every Egress Rule. Nothing Downstream Can Enforce One.

Author(s): Chew Loong Nian – AI ENGINEER Originally published on Towards AI. Google's AX Takes a Port in Every Egress Rule. Nothing Downstream Can Enforce One. Google’s agent orchestrator sets a port on six egress rules in its own repo. I traced all six to a wire format with no port field in it — and the CLI prints them back at you anyway. The article explains that although AX’s Gateway/HostRule schema includes a port field and both manifests and the CLI show it (e.g., “api.openai.com:443”), the underlying wire protocol to the enforcement layer contains no port information and the destination matcher logic only authorizes by hostname/IP, explicitly rejecting URLs and hostnames that include ports. It walks through a small “port check” script that traces how the wire path reads fields and shows that AX’s reconciliation and CLI formatting are misleading: port values may survive schema parsing and display, but they never reach enforcement. It further highlights ways the “fence” can unintentionally open—such as unresolved gateway names, wildcard short-circuiting, and empty allowlists causing no policy to be sent—and concludes with recommendations: treat Gateway as a hostname allowlist,…

≈