Policy demoRestrict where agents send data
Agents need to read from the web, but you probably want control over where they send data. With this policy, agents can still read from any site, but they can only send data to destinations you’ve approved. It also blocks the agent’s own telemetry from being sent out.
Gaurav Mahajan
October 31, 2026
About this demo
Agents need to read from the web, but most teams want tight control over where agents send data. In this demo, one static Qpoint policy enforces that. Agents can make any GET request, but POST and PUT requests are denied unless the destination is on a list of approved hosts, such as the endpoints Claude Code and Grok use for model inference.
We ask Claude Code to fetch a page from httpbin with curl, and the request goes through. Along the way, Claude Code tries to send telemetry to Datadog, and that’s blocked too, with no rule written for it. We then ask it to post team notes to httpbin, and the post is denied. We run the same prompts in Grok: its outbound data is blocked and the GET request is allowed.
See Qpoint in action in your environment
Request access and we'll get you set up.