Terms and egress
Use this page to look up a term from the Deploy section, or to copy the egress rule into a change request.
Terms and acronyms
Section titled “Terms and acronyms”| Term | Meaning |
|---|---|
| Agent Autonomy Zone | The operating envelope an agent works inside, expressed as intent policies across five dimensions: Quality, Economics, Security, Safety and Compliance. See Autonomy Zone |
| Agent Intent Policy (AIP) | The form in which your organization’s intent is authored in the console, and compiled to the deterministic rules that decide an action |
| Verdicts | Allow, Ask, Block or Optimize, in this order. Allow lets the action proceed. Ask lets it proceed and flags it for asynchronous review. Block stops it before it executes. Optimize changes the path: in Enforce a lever acts, and in Monitor it measures what it would have done. See Verdicts |
| Client | The OpenLatch software installed once on each machine that runs an agent. It decides a covered action, on the machine, before the action runs |
| Console | The OpenLatch web application at app.openlatch.ai, where you set up the organization, author policies and see what your agents did |
| Control level | How much control OpenLatch has over one agent. Enforced: the verdict reaches the agent and is obeyed. Monitored: events flow, but no verdict can be delivered. Known: the agent is identified and classified, with the limits of control stated. See Control levels |
| IdP | Identity provider: your organization’s directory and authentication service |
| MDM | Mobile device management: the tooling that delivers software and settings to managed machines |
| PAC / WPAD | Proxy auto-config and Web Proxy Auto-Discovery: a script that tells a client which proxy to use, and the mechanism that locates it |
| SAML 2.0 | Security Assertion Markup Language, version 2.0: the single sign-on protocol the console supports per organization |
| SNI | Server Name Indication: the TLS extension that carries the destination hostname in clear, which allowlisting by name reads |
| TLS inspection | A proxy that terminates and re-issues TLS to inspect traffic. Supported when the interception certificate authority is trusted |
| Wave | One stage of a rollout. The Deploy section runs three waves of growing size |
Egress requirements
Section titled “Egress requirements”Hand this table to whoever manages your egress. A machine running the client needs exactly one destination from OpenLatch, and the optional product telemetry and crash reports travel to it too. The second row is needed only while you install or update the client. The third is for the browsers that sign in to the console; no machine running the client contacts it.
| Destination | Port | Direction | Protocol | How to allow it |
|---|---|---|---|---|
app.openlatch.ai | TCP 443 | Outbound | HTTPS | By name. There is no static address range. This entry also carries the optional product telemetry and crash reports |
Your package registry: registry.npmjs.org, unless you point the client at a mirror | TCP 443 | Outbound | HTTPS | By name, or use your internal mirror. Needed for an install or an update, not to run |
challenges.cloudflare.com, from the browser of anyone who signs in to the console | TCP 443 | Outbound | HTTPS | By name, for browsers only. It serves the check the email step runs at sign-in |
Your agents reach their model endpoints exactly as before. Those endpoints must stay reachable, and exempt from response buffering and streaming inspection.
No inbound port is required, on the machine or anywhere else. OpenLatch issues no certificates and requires none. Network requirements is the full treatment, including proxies, authentication and TLS inspection.