How the agent connects to your network
The KEZEL agent initiates its connections and pulls instructions. Your team controls the permitted egress destinations.
Before deploying the agent, the network team needs to know which direction connections originate and which destinations they reach. KEZEL uses agent-initiated connections to the control plane, so the deployment does not require an inbound listening port.
The agent retrieves an encrypted instruction built from schema metadata and intent. Transport uses TLS 1.3; payload encryption uses AES-256 with vault-held keys. Source database credentials remain in the local environment. The control plane is built to plan without raw-row access.
Your team can run the agent as a Docker or Kubernetes container, a VM, or a system service. The choice depends on how you operate the environment and manage its credentials.
What the network review still covers
Agent-initiated connections still need approved destinations, firewall rules and monitoring. Review the agent's access to the source systems alongside its execution policy. An outbound connection is a network permission, not a substitute for a data-access review.
Restricted and air-gapped configurations remain a design target. The current deployment uses outbound connections initiated by the agent. Discuss those requirements early if the workload needs a different network pattern.
The deployment questions cover data access and supported systems. Use them to scope the review before choosing the first workload.
written by the KEZEL team at DBTEZ · all articles · book a demo