Where Odysseus Meets the Outside World
Odysseus's authority model becomes most concrete when an agent's next step leaves the conversation and touches a network, a file, an external tool, or a future schedule. This chapter compares those edges rather than treating “security” as one universal property. The reader will see why a public web fetch is pinned and bounded, why an administrator may intentionally configure a private model endpoint, why file-path protection is not a shell sandbox, and how MCP and scheduled tasks make configuration persist beyond the original request.
Network access is a sequence of decisions
A server-side request can be dangerous even when its URL looks ordinary. An attacker may hide a private address behind a hostname, rely on a redirect to move the request somewhere internal, exploit a DNS answer that changes between validation and connection, or return a body large enough to exhaust the process. Odysseus's public web-fetch path addresses these as separate stages.
The shared outbound-fetch primitive accepts only HTTP and HTTPS. It rejects loopback, private-network, link-local, reserved, multicast, unspecified, and cloud-metadata destinations, as well as hostnames that clearly indicate an internal environment. For a hostname, it resolves the address before connecting and pins the TCP connection to an approved result. The original hostname remains in the request URL, which preserves the Host and TLS server-name behavior needed by the destination; only the socket destination is fixed. This is the difference between checking where a name resolves and ensuring that the later connection actually goes there.
Redirects receive the same treatment. A public first response does not make every later location public, so each redirect is resolved and checked again rather than being followed as a blind convenience. The fetch also bounds the response body. A declared body above the hard ceiling is rejected, streaming stops at the soft budget unless the caller explicitly asks for the larger hard limit, and compressed responses are refused when their decoded size cannot be bounded reliably. The web tool reports when content was truncated instead of silently presenting a partial page as if it were complete.
These controls answer different questions. The URL classification asks whether the target is an acceptable public destination. DNS pinning addresses the time-of-check/time-of-use gap between that classification and the socket connection. Per-hop validation prevents a redirect from escaping the original policy. Body budgets protect the application from treating remote content as an unlimited local resource. A system that implemented only the first step would have an allowlist, but not the same transport boundary.
A simple example shows why the stages cannot be collapsed. A hostname may look public when it is first resolved, then return a different address when the HTTP client connects. A public landing page may issue a redirect to a link-local metadata address. A response may advertise a small length and then stream far more data, or use compression to make the decoded body much larger than the wire size. Odysseus's transport boundary is designed around the sequence that actually happens: resolve, classify, connect, follow a bounded number of locations, and read within a budget. The exact guarantee belongs to that sequence, not to the spelling of the initial URL.
Odysseus does not apply that public-web rule to every model connection. An administrator may configure a local or LAN model server because self-hosting is one of the workspace's purposes. A private model endpoint is therefore an intentional trust relationship, not an arbitrary URL supplied by an untrusted caller.