AI agents in containers act by opening network connections, and the text that drives them can be hostile. That makes egress a security boundary. But controls placed between the agent and its tools are bypassable: a child process or a direct socket can evade them, and the approval step is not enforced at the connection itself.
Connection Escrow addresses this by moving enforcement into the kernel. The kernel holds the pod's egress until an isolated verifier rules on it. Because the hold is in the kernel, a child process or a direct socket cannot skip it. The verifier runs separately from the agent, so the hostile text driving the agent does not influence the verdict.
The proposal is a design for making agent egress approval binding rather than advisory. It targets the specific gap where an agent's tools are approved but the agent itself can open connections outside those tools.