Can AI Agents Run Behind a Firewall?

Sam owns a screen printing and embroidery shop. The order system runs on a computer in the office closet, and the shop's IT provider set it up years ago so that nothing from outside can reach it. Sam wants an AI agent to read customer POs from email and enter them, and asks the IT provider if that's possible. The answer comes back: "Not if it means opening the firewall."

That answer is common, and it doesn't end the conversation. AI agents can work with systems behind a firewall. There are three ways to do it, and they ask very different things of your IT person.

Yes, AI agents can run behind a firewall. The agent can reach your systems through a narrow opening in the firewall, through a private connection, or by being installed inside your network so the firewall never has to change. Whichever you choose, also ask where the AI model runs, because that decides whether any text leaves your building.

What a firewall does, in one paragraph

A firewall is a set of rules that sits between your company's network and the internet. Think of it as the front desk of your building. Your staff can walk out to get lunch, which is like your computers reaching websites. But a stranger can't walk in and go to the back office unless the front desk has been told to let them through. Your order system, shared drives and sometimes your email server sit in that back office. A cloud AI agent is a stranger at the front desk.

Three ways an agent can reach what's behind it

11. Open a narrow door in the firewall

Your IT person adds a rule that lets one specific outside address reach one specific system. The cloud agent uses that door to read and write orders.

• Good for: shops whose IT person is comfortable with it, and systems that were built to be reached this way.
• What to watch: every opening is something to keep track of and review. Many IT providers say no to this for older systems, because those systems were never designed to face the internet.

22. Build a private connection

Your IT person sets up a private, encrypted link between your network and the vendor's. You may hear this called a VPN or a tunnel. The agent stays in the cloud, but it reaches your systems through that private link instead of the open internet.

• Good for: companies with IT staff who already run links like this.
• What to watch: it is one more thing to set up, monitor and fix when it drops. Ask the vendor whether they support it before you plan around it.

33. Install the agent inside your network

The agent software runs on servers inside your network, next to your order system. This is called on-premises or self-hosted. Because the agent is already inside, it reaches your systems over internal routes and the firewall doesn't need a new door.

• Good for: systems that can't or shouldn't be reached from the internet, and companies with contracts that say data has to stay on their own servers.
• What to watch: you need servers to run it on and someone to look after them. Our infrastructure checklist covers what that takes.

The question most people forget: where does the AI model run?

An AI agent has two parts. The agent is the software that reads your email, opens your order system and clicks the buttons. The AI model is what reads a messy PO and works out which line is the item, which is the quantity and which is the in-hands date.

Installing the agent inside your network doesn't automatically put the model there too. Many setups have the agent inside your building send the text of a PO to an AI model hosted somewhere else, then act on the answer. That can be perfectly acceptable, but it means some text does leave your network.

So ask the vendor two plain questions:

1. When the agent reads a PO, where is the text sent to be understood?
2. Is that place one my team gets to approve?

With Trelium, agents only call model endpoints your team has approved, and where that model runs is decided with you during setup, based on your data rules. Whatever you choose, nothing processed through Trelium is used to train AI models.

Which one fits your shop

• Your order system is a website you log in to. You don't have a firewall question. The system is already on the internet, and a cloud agent connects to it the same way you do.
• Your order system is on a local computer, and your IT person is open to a narrow rule or a private link. Ask the vendor which of those they support and start there.
• Your IT person says nothing comes in, or a contract says data stays on your servers. Install the agent inside your network.

If you are unsure which camp you're in, our post on cloud vs. on-premises AI agents walks through four questions that settle it.

What to bring to your IT person

Your IT person will give you a faster, better answer if you show up with specifics. Write these down before you ask:

• Which systems the agent needs. For order entry: the inbox it reads from and the order system it writes to.
• Whether it reads, writes or both. Reading orders is a smaller ask than creating them.
• What the agent must never do. For example: never change pricing, never release an order to production without a person.
• Who approves its work. Name the person on your team who checks drafts before they go live.
• Your data rules. Any customer contract or policy that says where data can be stored.

What Sam did

Sam brought that list to the IT provider. The provider still wouldn't open the firewall for the old order system, so Sam looked at an install inside the network. The provider agreed to run it, because nothing about the firewall had to change and Sam's team would approve every order before it was saved.

FAQ

1Does running an agent behind a firewall make it safe?

It keeps outsiders from reaching it directly, which helps. But safety also depends on what the agent is allowed to do, who approves its work and whether its actions are logged. A firewall doesn't replace any of those.

2Will an on-premises agent still need internet access?

Possibly, for example to reach an AI model or to read a cloud email inbox. Ask the vendor for a list of every outside address the agent connects to, so your IT person can approve each one.

3My order system has no way for software to connect to it. Can an agent still use it?

Often, yes. Some agents can work through a system's normal screens, the same way a person does, when there's no other way in. With Trelium, a browser agent does this through the system's web interface. Ask about it for your specific system.

4Can I try it before changing anything?

Yes. Start with an agent that only reads and drafts, with a person approving everything before it's saved. That lets your team see how it works before anyone gives it more access.