Firewall Rule Tuning Checklist
Rules drift. Monthly tuning keeps them right. Here's the checklist.
The checklist
1. Blocked-but-legit: any BLOCKED transactions that should have passed? Raise the rule or add the merchant.
2. Flagged outcomes: all approved → threshold too low. All denied → agents trying the wrong things.
3. Ceiling proximity: spend consistently near the cap → the cap IS the budget, confirm it's right.
4. New merchants: add legitimate ones to the allowlist, block the rest.
5. One change: make ONE rule change this cycle and measure it next cycle.
6. Document: log the change and its rationale.
FAQ
How often should I tune?
Monthly, or after any incident.
What's the risk of tuning too often?
Noise — you can't measure a change you made alongside five others.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check