Natural-language firewall rules, with a human in the loop

Firewall rules have always been written in a language made for machines: protocols, address ranges, ports, directions, priorities. That is precise, and it is also why most people never write one. Natural-language rule generation flips the interface: you say what you want, in your own words, and the software translates it into a rule. Done well, it lowers the barrier to good security. Done badly, it turns a vague sentence into a silent, wrong change to your defences.

Two ways to turn words into rules

• A deterministic parser: recognises a known set of verbs (block, allow, switch), objects (an app, a company, a domain) and conditions (hours). It is predictable and easy to test, but it only understands what it was built to understand.
• A language model: understands far more phrasing and can resolve names it has never seen in a list. It is also probabilistic, can be confidently wrong, and can be steered by text it reads.

The safest designs combine them: a strict parser for the actions, and a model only where flexibility really helps, such as recognising an unfamiliar name. The action itself should always come from a small, known list.

What can go wrong

The OWASP Top 10 for LLM Applications names two risks that apply directly. Excessive Agency (LLM06) is what happens when a model is allowed to take actions with more permission or autonomy than needed, so one misunderstanding becomes a real change. Prompt Injection (LLM01) is text crafted to change a model’s behaviour; a firewall assistant should never read an app’s own description or a web page and treat it as an instruction. The NIST AI Risk Management Framework adds the general principle: keep humans able to oversee, understand and override AI-driven actions.

• Ambiguity: does “block Google” mean the browser, the company’s servers, or both?
• Over-reach: a sentence that quietly turns off protection or allows far more than intended.
• Silent failure: the system guesses rather than saying it did not understand.
• No trail: a rule nobody can trace back to the sentence that created it.

A safe pattern: preview, confirm, record, undo

The answer is a short checklist. Show the user what was understood before anything changes. Require an explicit confirmation. Keep the original sentence next to the rules it created. Make removal easy. And when the input is not understood, say so instead of guessing.

How Ask FireAI does it

Ask FireAI is a text box at the top of FireAI’s Home page. You type an order such as “block Teams” or “go in coffee shop mode”. It understands orders directly in fourteen languages, including English, French, German, Spanish, Chinese and Arabic. The list of things it can do is deliberately short:

• Add a Block or Allow rule for an app, a company or a domain, optionally only at certain hours.
• Switch the security mode (Home, Coffee shop, Paranoid, Under attack) or the operating mode (Alert, Autopilot, Silent – allow, Silent – deny).
• Turn the kill switch, or Protection itself, on or off.
• Start or stop an activity profile.

Before anything changes, FireAI shows a preview: a one-line summary and the details of what it understood. Nothing is written until you click Apply; Cancel walks away. Every applied order that adds a rule is kept in your own words under Settings › Your preferences, and deleting a preference also deletes the rules it created. If nothing was understood, FireAI says so and suggests a simple example rather than guessing.

Where does the AI come in? The orders are understood directly, without a model. Only when FireAI recognises the verb but not a name, for example a company written in a script it does not resolve, and the optional on-device AI is turned on, does the model get one more chance to name it. That model runs on the Mac. Without it, simple orders still work; FireAI just cannot guess unfamiliar names. The model helps with words; it does not decide what action is taken, and you still confirm the result.

The broader lesson for AI in security tools: let the model make the interface easier, keep the set of actions small and known, and leave the final click to a person.

Before trusting any assistant with your settings, try three sentences on it: a clear order, an ambiguous one, and one it should not understand. A good design shows you exactly what it understood, asks when it is unsure, and admits when it is lost.