A network agent with bounded autonomy, verified before every change

The challenge

A route leak grows faster than a ticket queue. When an external BGP peer starts announcing prefixes it should not, every router behind it fills its table, and past the limit a router starts dropping routes. An agent can see this coming and propose the fix, but every fix touches production BGP. Each change has to be measured, bounded and recorded before it applies, and the risky ones have to reach a person.

What was at risk:

• Router tables at their limit, new routes that cannot be programmed and silent forwarding loss, or an agent that changes production BGP without proof the change is safe

What we did

• A lab fabric of two spines, six leaves and three external BGP peers, with an agent running a six-step loop from detection to validation
• Forecasting tools exposed to the agent over MCP, so it asks when a router will reach its table limit and which peer drives the growth
• A ranked menu of fixes, from a surgical prefix filter to an enforcing prefix limit, each with its blast radius
• A Verify Gate with a change-stop, a signed dry run on the router’s live tables, a blast-radius check and rollback
• Autonomy levels: inside a pre-approved envelope of 5% of a router’s table the agent acts alone, and above it a person approves
• Supervision of the agent itself: a policy gateway, one-time tickets, a hash-chained audit journal and quarantine when it tries to act outside its estate

How it works

The agent runs a six-step loop from detection to validation, and every change it proposes passes the Verify Gate before it touches a router.

1. Detect and forecast The agent watches routing-table growth on every router in the fabric and asks a forecasting tool when each one will cross its table limit. In the demo it forecast about five hours ahead that three leaf routers would reach their limit.
2. Attribute The agent compares the prefixes received from each external peer and ranks them by growth, which traced the leak to one peer.
3. Propose For the leaking session, the agent sizes a set of fixes and ranks them from surgical to blunt: filter the peer down to its agreed prefixes, set a warning-only prefix limit, set an enforcing limit, or do nothing, with the consequence of each spelled out.
4. Verify Gate Before any change applies, the gate stops other changes, runs a signed dry run against the router’s live tables, checks the blast radius and prepares a rollback.
5. Decide by autonomy level A change inside the pre-approved envelope of 5% of a router’s table applies on its own. Above it, a person approves: the change removing 42% of a table went to a person, while the two changes inside the envelope applied alone.
6. Validate and record The agent checks the result on the router. Leaked prefixes went from 2,383 to 256, as the dry run predicted. Every step lands in a hash-chained audit journal, and an action outside the agent’s estate is refused and the agent quarantined, in about one second.