Denials are on the record
A blocked destination becomes a trace event — what, where, when — not a silent timeout.
WhereTracing
Introduced Jun 3, 2026
tool · postgres_query312ms
egress denied
- destination
- pastebin.com
- rule
- no match → denied
- recorded
- 11:14:07 · on the run
summarization148ms
How it works
A denial is an event.
When an agent tries a destination outside its rules, the attempt lands on the run — what it tried, where, and when.
Not a silent timeout.
You see the block where it happened instead of debugging a mystery hang.
Evidence, not anecdotes.
Your security team reads attempts from the trace, not from someone's recollection.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.