Add idea: localhost-only egress for agent workloads

[rrashidov]

What is this idea about?

An agent's outbound calls are decided at inference time — the developer cannot enumerate them statically, and a misconfigured or prompt-injected agent can silently reach unintended hosts. Direct network access from the agent process makes this uninspectable by default.

The proposal: CF should route all outbound agent traffic through a platform-owned proxy the workload cannot bypass. The developer declares bindings in the manifest (e.g. a model provider, a tool endpoint); the platform provides a localhost address the app calls, and the proxy handles the real outbound connection — enforcing the declared policy and logging every request. The app code doesn't change, only the target hostname does. What the proxy looks like and who owns egress policy is left open for platform experts to propose.

Checklist

• File lives in ideas/ with a lowercase kebab-case filename (ideas/localhost-only-egress-for-agents.md)
• Has a title (YAML title: present)
• Tags added (sandboxing-isolation, observability-governance)
• On-topic for agentic workloads on Cloud Foundry
• Cross-links to sibling ideas

Related

• Assumes the isolation foundation in PR Add idea: stronger workload isolation for agent workloads #6 — ideas/stronger-workload-isolation-for-agents.md
• Sibling idea (to be submitted as a separate PR): ideas/credential-less-agent-processes.md