Trust Center Sign in
Endpoint modulesNGAV / Malware PreventionFirewall & Firewall PolicyApp ControlDevice ControlDLPFileHunt & QuarantineFile Integrity MonitoringHost InventorySoftware Inventory / SBOMPatch ManagementExposure ManagementExposure ControlEncryption PostureIdentity & ITDRSession AssuranceZTNA PostureThreat IntelligenceCustom DetectionsObservabilitySIEM ForwardingBrowser & IDE SecurityComplianceEndpoint EffectorsIR ShellAutonomic RemediationAnalyst Workflows
OffensivePenetration TestingRed TeamingAI Red TeamingAdversary SimulationVulnerability AssessmentsApplication Security AssessmentsDetectionManaged Detection & ResponseThreat HuntingIncident Response RetainersIncident Readiness & ResponseDetection EngineeringPreparednessTabletop ExercisesRansomware Readiness AssessmentsIncident Response Plan Development and TestingSecure Software Development AssessmentArchitectureSecurity Program DesignSecurity Maturity AssessmentsZero Trust AssessmentsCloud Security Architecture ReviewsRiskSupply Chain Risk ManagementSoftware Supply Chain SecurityQuantum Readiness AssessmentsData Security Assessments
Architecture LibraryWhitepapersPerspectivesAnalyst & Investor BriefingsGlossaryEvents
Company overviewVisionCode of EthicsLeadershipCareersNews & PressContact
Worldwide (EN) Australia Brazil France Germany India Japan Korea LATAM Singapore United Kingdom
Sign inContact us
Platform capability · Protect

Firewall & Firewall Policy

Control network access rules

Turn endpoint context into bounded network control, with policy-defined releases, native-state verification, and an evidence path for every consequential change.

Request a demo →
The capability

Make the network boundary part of the control loop

Spacetime treats firewall policy as an endpoint state to govern and verify—not a static rule file that disappears into a separate console.

Policy-defined

Translate declared intent into bounded ingress and egress controls at the endpoint boundary.

Context-aware

Use endpoint posture and security context to inform network-control decisions.

Verified

Compare intended policy with native firewall state and preserve the result as evidence.

What it governs

A precise boundary for connected systems

Firewall control is most useful when it is legible: teams can see what was intended, what changed, and whether the endpoint reached the expected state.

Policy surface

Declare the boundary

  • Ingress and egress intent
  • Scoped releases and maintenance windows
  • Native platform state
  • Tenant and device context
Control loop

Prove the result

  • Validated policy input
  • Bounded local action
  • Native-state verification
  • Evidence tied to outcome
How it stays governed

Control without losing the audit trail

The platform keeps network action inside explicit authorization and verification boundaries, with safe handling for maintenance and degraded conditions.

Boundary · 01

Authorize

Validate policy scope, device identity, and the conditions for a change.

Boundary · 02

Apply

Use bounded releases and native controls rather than unscoped network changes.

Boundary · 03

Verify

Confirm native state and preserve evidence of the policy outcome.

Current evidence

Runtime-integrated locally

Local firewall modes, bounded releases, native-state verification, and evidence records are implemented in the macOS agent path.

Qualification

Convergence remains gated

Live pre-production convergence and control-plane delivery of custom firewall rules remain external proof points. This page does not claim universal network enforcement.

See the boundary

Discuss firewall policy in your environment

Review network-control scope, deployment conditions, evidence, and the maturity path with the Spacetime team.

Request a demo →