How to pick your first three firewall rules
You don't need all six rule types on day one. The three that cover the most documented failure modes — and how to set them in one session.
New teams often ask for every rule type at once. The incident database suggests otherwise: three rules cover the majority of documented failure modes. Start there, then tune with your audit log.
Rule 1: the per-transaction cap
Block any single purchase above a ceiling. This is the bluntest rule and the most valuable — the largest documented runaways start with one oversized transaction that nothing screened. Set it at the largest 'no review needed' purchase for the agent.
Rule 2: the merchant allowlist
Only approved vendors can be paid. Unknown vendors are the second-most-common failure shape — and the allowlist makes them default-deny. Start with the three to five vendors the agent actually uses.
Rule 3: the velocity limit
A cap on transactions per window. This is the rule that kills retry loops — the single most common runaway pattern in the database. Start at 10 calls per minute for general agents, 5 for trading/finance.
One session, three rules
Set all three in the dashboard (or via the API), then watch the audit log for a week. The log — not the rule count — is what tells you what to add next. Build the policy around them →