Network Extension

Network Extension is how macOS lets software participate in networking without a kernel extension. It covers VPNs, DNS proxies, and — the relevant part here — content filtering.

For AI containment the important class is NEFilterDataProvider: a system extension that sees network flows and returns a verdict on each one.

Why per-flow, and not a firewall rule

A firewall rule is written against addresses and ports. That is the wrong shape for this problem, because the question is not “may anything reach this host” but “may this contained subject reach this host”.

Two agents on the same machine should have different network authority. A flow filter that can attribute a flow to a process — and through it to a containment session — can answer that. A rule in pf cannot.

It also lets destinations be classified rather than listed. Loopback, local network, multicast and internet are separate categories decided from the address bytes, so an agent allowed to reach one API endpoint has, on that basis, no authority to scan your subnet or open a local service port. See network containment.

The application bypasses the app

The reason a Network Extension is necessary at all, rather than intercepting at the application layer: a contained process can bypass whatever networking its own UI uses and create host network flows directly. Anything that shells out to curl, opens a socket, or runs a runtime with its own stack is outside application-level controls.

Filtering has to happen where the flows actually are, which is the OS.

Entitlement and approval

com.apple.developer.networking.networkextension with the content-filter-provider-systemextension capability is another restricted entitlement requiring Apple approval, and — as with Endpoint Security — the entitlement is only the first gate. The provider must be signed, packaged, installed and approved by the user.

Note the split that a careful implementation makes: the restricted entitlement belongs to the Network Extension bundle, not to the GUI app. The host application holds only the system-extension installation entitlement. Concentrating restricted capability in the smallest component that needs it is the same least-privilege logic applied to the product’s own architecture.

BitShout holds this entitlement — Apple approved it. Packaging, installation and the user’s own approval on the machine are what remain between a policy decision and an operating-system denial, and where that chain is incomplete the verdict is labelled a policy evaluation rather than a block.