How Tether delivers it

A proxy on every dev machine.
A control plane in your cloud.

Tether is three things in one shape: a loopback proxy on the developer machine, a single-tenant Overwatch in your cloud account, and a deterministic floor that always blocks — backed by an optional sync judge that fails closed, and an advisory async judge that produces evidence.

The shape of the problem

The AI-egress lane lives on the developer machine.
Enforcement has to live there too.

Cloud proxies you can walk around are policy documents with a certificate attached. EDR sees the connection but not the payload. The control belongs at the loopback boundary on the developer machine, in front of whatever HTTP path the agent talks to — and behind a control plane your security org can authenticate.

Architecture

One picture.

Three runtimes, two trust boundaries, one signed policy bundle.

DEVELOPER MACHINE CUSTOMER CLOUD ACCOUNT — GCP OR AWS Coding agent Claude Code · Cursor · Copilot · Codex CLI Aider · Zed · VS Code extension HTTP_PROXY → 127.0.0.1:11435 Connect proxy · loopback only 127.0.0.1:11435 — kardianos service · Go TIER 0 deterministic blocklist · always blocks TIER 1 sync judge · fail-closed on timeout TIER 2 async judge · advisory · cannot block Workspace daemon 127.0.0.1:11436 — clipboard / downloads / external links Today: advisory. Enforcing when managed VSCodium ships. Upstream AI vendor api.anthropic.com · api.openai.com · ... Overwatch — single-tenant in your cloud Cloud Run (GCP) or ECS Fargate (AWS) — Node.js / Express POLICY-STORE · Ed25519-signed bundles · versioned · audited EVENTS · access-requests · judge-reviews · agents · devices SSO (Jackson SAML/OIDC) · SCIM webhook · posture export Judge — customer-supplied Local Ollama (4 hardware tiers) OR cloud (OpenAI-compatible) Default sample rate 3% · max 10% Your security stack Splunk HEC · Sentinel LA · syslog UDP Okta / Entra · Jackson SCIM Tether is an additive control TETHER_DATA_DIR policy.json (versioned bundles) · policy-audit.jsonl (append-only) Lives in your VPC. No Tether-hosted data transit. X-Tether-Policy-Version: 42 — on every response · auditor verifies offline against signed bundle policy poll · 10s Ed25519 verify judge call
DEVELOPER MACHINE
Coding agent
Claude Code · Cursor · Copilot · Codex CLI · Aider · Zed · VS Code extension
HTTP_PROXY → 127.0.0.1:11435
↓
Connect proxy · loopback only
127.0.0.1:11435 — kardianos service · Go
TIER 0 deterministic blocklist · always blocks
TIER 1 sync judge · fail-closed on timeout (opt-in)
TIER 2 async judge · advisory · cannot block
↓
Workspace daemon
127.0.0.1:11436 — clipboard / downloads / external links
Today: advisory. Enforcing when managed VSCodium ships.
↓
Upstream AI vendor
api.anthropic.com · api.openai.com · …
CUSTOMER CLOUD ACCOUNT — GCP OR AWS
Overwatch — single-tenant in your cloud
Cloud Run (GCP) or ECS Fargate (AWS) — Node.js / Express
POLICY-STORE · Ed25519-signed bundles · versioned · audited
EVENTS · access-requests · judge-reviews · agents · devices
SSO (Jackson SAML/OIDC) · SCIM webhook · posture export
↓ policy poll · 10s · Ed25519 verify ↑
Judge — customer-supplied
Local Ollama (4 hardware tiers) OR cloud (OpenAI-compatible)
Default sample rate 3% · max 10%
Your security stack
Splunk HEC · Sentinel LA · syslog UDP · Okta / Entra · Jackson SCIM
Tether is an additive control
TETHER_DATA_DIR
policy.json (versioned bundles) · policy-audit.jsonl (append-only)
Lives in your VPC. No Tether-hosted data transit.
X-Tether-Policy-Version: 42 — on every response · auditor verifies offline against signed bundle

Source visual is adapted from docs/JUDGE_AUTHORITY.md and deploy/README.md.

Dataflow

What happens on every request.

01

Agent dials the proxy

main.go:98-103
The coding agent reads HTTP_PROXY from its environment and opens a connection to 127.0.0.1:11435. The proxy is loopback-bound by default; widening requires explicit operator config and emits a startup warning. The VS Code extension can opt-in to set the env var for terminals VS Code spawns — Tier 2 agents are governed without separate dev setup.
02

Tier 0 — deterministic floor

proxy_core.go:114-117
Compiled regex over the embedded floor plus operator-promoted patterns. If a pattern matches, the response is HTTP 403 with the reason text and the forward path is not reached. Tier 0 cannot be opted out of at runtime. The forward path never runs on a match. The decision is reachable in the audit log under verdict: BLOCKED.
03

Tier 1 — sync judge (opt-in), fail-closed

proxy_core.go:130 proxy_core.go:158-181
Configurable; sync-block opt-in at deploy time. When both CloudJudgeCanBlock and CloudJudgeEnabled are true, the judge runs in-band with a default 800 ms timeout. On a BLOCKED verdict, the proxy returns 403. On timeout or empty response, the verdict converts to BLOCKED with reason "cloud judge (sync): timed out — failing closed." A network adversary cannot defeat blocking by delaying judge calls. This is the 2026-06 hardening.
04

Tier 2 — async judge, advisory

proxy_core.go:183-188
When sync-mode is off, the judge runs in a goroutine after the response has already been forwarded. It cannot rewrite, block, or retract the response — by invariant. What it can do: produce a judgeReview record with promptDigest.sha256, a 200-character preview, and a verdict an operator can promote to the Tier 0 floor for future requests. The customer for Tier 2 is the operator console and the SIEM, not the developer.
05

Receipt on every response

docs/ATTESTATION.md
The proxy sets X-Tether-Policy-Version: <version> on every blocked 403 and every forwarded response. The corresponding event in your SIEM carries the same policyVersion. An auditor pulls GET /api/v1/policy/versions/<version>, retrieves the signed bundle, and runs an offline Ed25519 verification against the controls in force at decision time.
Judge authority

"The judge said ALLOWED" is not the same as
"the request was allowed."

The framing depends on the tier. Tether is honest about which one is in effect, which is why the three tiers exist in the code as distinct branches — not a single configurable knob.

TIER 0 — DETERMINISTIC FLOOR

Always blocks. No opt-out.

Operator opt-out? No.

Compiled regex over the embedded floor plus operator-promoted patterns. The forward path is not reached on a match. This is the only enforcement layer a regulated customer can rely on to block by policy alone — no model, no network, no opinion.

blocklist.go:138
TIER 1 — SYNC JUDGE

Blocks when enabled. Fails closed on timeout.

Configurable; sync-block opt-in at deploy time.

The judge runs in-band with a default 800 ms timeout. When enabled, it blocks in-band and fails closed on timeout — the verdict converts to BLOCKED on timeout or empty result. If CloudJudgeCanBlock is left false, the judge runs as Tier 2 advisory.

JUDGE_AUTHORITY.md
TIER 2 — ASYNC JUDGE

Records. Cannot block. By invariant.

Operator opt-in? No effect on the current request.

Runs in a goroutine after the response is forwarded. Produces a judgeReview the operator can promote to the Tier 0 floor — affecting future requests, not the one being judged. The async path has no handle on the response that already went out. By construction.

proxy_core.go:245

For known patterns, Tier 0 is the strong guarantee. For novel content, Tier 1 blocks if the operator opted in. For TLS-tunneled traffic that does not route through the configured plaintext upstream, the proxy classifies the destination host but does not read the body — see the Security page for the full scope.

Honest scope

What the proxy sees
and what it does not.

In scope
  • CONNECT destination classification. The proxy sees the host on the CONNECT tunnel and can block unapproved AI vendors and off-allowlist marketplace installs at the host level.
  • Configured-upstream content inspection. When an agent supports a base-URL override (Claude Code, Codex CLI, OpenAI-SDK consumers, Continue, aider), Tether reads the full prompt, runs the deterministic floor, and optionally invokes the judge before forwarding.
  • Identity attribution. Every decision carries the developer's SCIM identity, the agent label, the host, and the policy version.
Out of scope today
  • TLS-tunneled body inspection. The Connect proxy does not perform TLS interception. No root CA is installed on the developer machine. Workspace-tier TLS termination is reserved for the future managed VSCodium build.
  • Workspace daemon enforcement. Clipboard, downloads, external links, screen capture, and coach mode are advisory today. The daemon returns the right decision and emits the audit; the IDE-side enforcement seam ships with the managed VSCodium artifact.
  • Tools that bypass HTTP_PROXY. An extension or CLI agent that binds its own socket bypasses the proxy. Tether governs the AI-egress lane for the tools your developers are authorized to use.
  • MCP servers that hardcode their own endpoint. MCP-server-bound traffic that bypasses HTTP_PROXY does not pass through the loopback proxy. Recommendation: allowlist MCP endpoints at the proxy host-classification layer; monitor for novel destinations in the operator console. Cooperative MCP agents that speak Tether's tether_may_i_* surface stay in scope — see warden/cmd/proxy/mcp.go.

Walk through it on your environment.

We bring the architecture diagram. You bring the dev-machine OS, the IdP, the SIEM, and the two AI tools you actually use.

Book a 30-min walkthrough ↗