# How OpenWork Manages and Enforces Outbound Access Controls for Enterprise Users

> Discover how OpenWork manages and enforces outbound access controls for enterprise users using its robust five-layer architecture. Stay secure with advanced validation and policy verification.

- Repository: [Different AI/openwork](https://github.com/different-ai/openwork)
- Tags: how-to-guide
- Published: 2026-07-31

---

**OpenWork enforces enterprise outbound access controls through a five-layer architecture that combines a declarative host manifest, runtime URL validation against RFC 1918 private ranges, a guarded fetch wrapper with redirect inspection, egress policy verification, and telemetry emission for every request.**

OpenWork Den implements strict **outbound access controls** to prevent enterprise deployments from inadvertently contacting unauthorized external services or exposing internal infrastructure. Every HTTP request that leaves the backend undergoes multiple validation stages, from manifest-based host allowlisting to deep inspection of DNS-resolved IP addresses. This article examines the source code implementation in the `different-ai/openwork` repository to explain how these security boundaries are constructed and enforced.

## The Five-Layer Security Architecture

The Den server processes outbound traffic through a defense-in-depth strategy comprising five distinct validation layers.

### 1. Declarative Host Manifest

The foundation of the policy is [`docs/enterprise/outbound-access.json`](https://github.com/different-ai/openwork/blob/main/docs/enterprise/outbound-access.json), a JSON file serving as the **single source of truth** for allowed external hosts. Each entry defines the host, purpose, requirement level, and the effect if blocked:

```json
{
  "host": "api.openai.com",
  "kind": "fetched",
  "components": ["renderer","server"],
  "purpose": "Direct OpenAI Realtime voice and image-generation calls when the user provides an OpenAI key.",
  "requirement": "opt-in",
  "blockedEffect": "Direct OpenAI voice or image features fail for users who configured OpenAI.",
  "override": null
}

```

Enterprise admins can modify this manifest via the Den UI, but the runtime guard checks every request against this baseline file before allowing network egress.

### 2. Runtime URL Validation

Before any external URL is stored or invoked, the system calls `assertPublicUrl` from [`ee/apps/den-api/src/capability-sources/url-guard.ts`](https://github.com/different-ai/openwork/blob/main/ee/apps/den-api/src/capability-sources/url-guard.ts). This function implements the **public-only rule**:

- Rejects non-HTTPS URLs immediately
- Parses hostnames and blacklists private IP ranges (RFC 1918, link-local, loopback, multicast)
- Performs DNS resolution for domain names and verifies **all** resolved IPs are public
- Throws `PrivateUrlError` if any check fails

This prevents users from configuring MCP endpoints, OAuth clients, or tool-call URLs that point to internal infrastructure.

### 3. Guarded Fetch Wrapper

All outbound HTTP traffic routes through `createGuardedFetch`, exported from the same [`url-guard.ts`](https://github.com/different-ai/openwork/blob/main/url-guard.ts) file. This wrapper:

- Re-runs `assertPublicUrl` **before each request** and after every redirect
- Enforces HTTPS-only redirects; downgrades from HTTPS to HTTP abort with `PrivateUrlError`
- Disallows cross-origin redirects that would carry request bodies (protecting OAuth tokens and MCP arguments)
- Limits redirects to **5** hops maximum to prevent infinite loops

The MCP SDK throughout the Den codebase uses this wrapper exclusively to ensure consistent policy enforcement.

### 4. Egress Policy Enforcement

When a request is about to be transmitted, the Den loads `OUTBOUND_ACCESS_MANIFEST` in [`evals/packages/labs/src/egress.ts`](https://github.com/different-ai/openwork/blob/main/evals/packages/labs/src/egress.ts). The `outboundManifestFromUnknown` function consults this manifest to confirm the target host is explicitly allowed for the current tenant. If the host is missing or marked `required-for-cloud` without authorization, the request is **blocked** and returns a diagnostic message directing developers to the manifest file.

### 5. Telemetry and Fault Injection

For observability and testing, every outbound request emits an event with `direction: "outbound"` via [`packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts`](https://github.com/different-ai/openwork/blob/main/packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts). This allows the enterprise MCP mock server and egress lab tests to verify policy compliance and simulate fault conditions such as "blocked host" or "malformed-resource-metadata".

## Implementation Examples

### Validating User-Provided MCP Endpoints

When registering a new MCP server, enforce the public URL policy using the same guard internal to the Den:

```typescript
import { assertPublicUrl } from "@/capability-sources/url-guard";

async function registerMcpEndpoint(rawUrl: string) {
  // Throws PrivateUrlError if URL is not HTTPS or resolves to private IP
  await assertPublicUrl(rawUrl);
  // Safe to persist
  await tenantConfig.set("mcpEndpoint", rawUrl);
}

```

### Executing Outbound Requests Safely

Use the guarded fetch wrapper for all external API calls to ensure redirect safety and manifest compliance:

```typescript
import { createGuardedFetch } from "@/capability-sources/url-guard";

const fetch = createGuardedFetch(); // Wraps global fetch

async function callExternalTool(url: string) {
  // Validates URL and all redirects automatically
  const response = await fetch(url, { method: "GET" });
  if (!response.ok) throw new Error(`Failed: ${response.status}`);
  return response.json();
}

```

### Self-Hosted Override Configuration

For on-premises deployments requiring access to internal MCP servers, bypass the public URL restriction:

```bash

# Allow private IP addresses in self-hosted Den

export DEN_ALLOW_PRIVATE_MCP_URLS=1

```

When this environment variable is set, `assertPublicUrl` permits private addresses, useful for internal network integrations.

## Summary

- **Outbound access controls** in OpenWork rely on a JSON manifest at [`docs/enterprise/outbound-access.json`](https://github.com/different-ai/openwork/blob/main/docs/enterprise/outbound-access.json) that defines all permissible external hosts.
- The `assertPublicUrl` function in [`ee/apps/den-api/src/capability-sources/url-guard.ts`](https://github.com/different-ai/openwork/blob/main/ee/apps/den-api/src/capability-sources/url-guard.ts) enforces HTTPS-only public endpoints by checking against RFC 1918 private ranges.
- `createGuardedFetch` provides a drop-in replacement for `fetch` that re-validates URLs during redirects and limits hops to 5.
- The egress policy engine in [`evals/packages/labs/src/egress.ts`](https://github.com/different-ai/openwork/blob/main/evals/packages/labs/src/egress.ts) performs final allowlist verification before transmitting requests.
- Telemetry events emitted from [`packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts`](https://github.com/different-ai/openwork/blob/main/packages/enterprise-mcp-mock-server/src/protocol/oauth-handler.ts) enable testing and monitoring of policy adherence.

## Frequently Asked Questions

### What happens if a user attempts to connect an MCP server with a private IP address?

The `assertPublicUrl` function throws `PrivateUrlError` immediately upon validation. This error propagates to the user interface, preventing the configuration from being saved and blocking any attempt to enumerate internal infrastructure through the MCP connection.

### How does OpenWork handle malicious redirects during outbound requests?

The `createGuardedFetch` wrapper re-applies `assertPublicUrl` validation **after every redirect**. If a redirect attempts to downgrade HTTPS to HTTP, targets a private IP, or exceeds 5 hops, the wrapper aborts the request and throws `PrivateUrlError`, preventing token or data exfiltration to attacker-controlled endpoints.

### Can self-hosted enterprise deployments access internal MCP servers behind firewalls?

Yes. Setting the environment variable `DEN_ALLOW_PRIVATE_MCP_URLS=1` disables the public-IP requirement in `assertPublicUrl`, allowing the Den to connect to RFC 1918 addresses and internal hostnames. This override applies only to the specific tenant configuration and does not affect the egress manifest validation layer.

### Where is the canonical list of approved external endpoints maintained?

The **single source of truth** resides in [`docs/enterprise/outbound-access.json`](https://github.com/different-ai/openwork/blob/main/docs/enterprise/outbound-access.json). This declarative manifest enumerates every permissible host, required components, and the business impact if access is blocked, ensuring enterprise admins have explicit control over their attack surface.