Agent can't reach a website

What you see

• The AI agent says a website or online service refused it, often with the words 403 Forbidden or Access denied.
• The agent says it could not download a file, open a page, or call an online service.
• The same website opens fine in your own browser.

Why it happens

The agent works inside a sandbox, a sealed-off space on your computer. Every website it tries to reach goes through Levee first, and Levee only lets through the sites your organization's web access policy allows. Anything else is refused.

The agent always gets the same answer, Access denied., whatever the reason: the site is not allowed, you declined it, or it is an internal address. This is on purpose. It stops a misbehaving agent from learning about your network. The real reason is recorded on your computer, where you and your IT team can read it.

What you can try

1. See which site was refused

1. Open the project in the Levee app.
2. Select the Activity tab.
3. Find the refused request. It shows the website address and the reason.

2. Approve it if Levee asks

Some sites are set to "ask first". When the agent tries to reach one, Levee shows an Access Request. Approve it and the agent can continue. A request nobody answers is declined after 5 minutes. Ask the agent to try again, and approve it this time. See Approvals.

3. Ask for the site to be allowed

If the site is simply not allowed, only your organization can open it up. Send your IT team the website address from the Activity tab and what you need it for.

Downloads often jump to a second address, such as a storage or delivery site. If the first site is allowed but the download still fails, look in Activity for a second refused address and send that one too.

Levee asks again about a site I approved before

A remembered decision belongs to one project folder and to the Windows user who started the project. Levee asks again when:

• You moved the project folder, or another Windows user started the project.
• You just updated to Levee 0.58.3 or later. Levee asks once more about decisions you had remembered before the update.

Approve again, and choose to remember the decision if you want.

The agent needs an internal company site

Levee never lets the agent reach internal company addresses through the web, even if a rule allows the name. Your organization can give the agent controlled access to internal data in other ways: Database access, Microsoft 365, or Packages.

The site needs me to be signed in

If a site needs your company sign-in, you can sign in once in Levee and let the agent use that session without seeing your password. See Connected identities.

The error is about the AI model, not a website

Calls to the AI model go through a different part of Levee and fail with different messages. See AI model errors.

The Levee app closes at start with "Access is denied"

Levee versions before 0.58.1 closed at start with an "Access is denied" error for users who are not administrators on their computer. Ask your IT team to update Levee to 0.58.1 or later.

For your IT team

Find the reason

Inside a project, every HTTP and HTTPS request goes through Levee's web access proxy (HTTP_PROXY and HTTPS_PROXY in the container). Operating-system network enforcement blocks any traffic that tries to bypass it.

levee audit tail --lines 100

Look for http.denied events. The resource shows the destination (host:port and path, or CONNECT host:443) and the detail shows the reason. For more detail, read the web proxy log for the project:

levee project list
levee log tail --component proxy.http --project <project-id> --since 30m

Allow the host

Web access is deny by default. Add a rule for each host the agent needs. In policy (proxies.http), rules are checked in order and the first match wins:

{
  "proxies": {
    "http": {
      "default": "deny",
      "rules": [
        { "domain": "github.com", "action": "allow" },
        { "domain": "*.githubusercontent.com", "action": "allow" },
        { "domain": "registry.npmjs.org", "action": "allow" }
      ]
    }
  }
}

In the Vediram Portal, the same rules are under Policies > HTTP. See Web access.

Common mistakes:

• Wildcards do not match the domain itself. *.example.com matches api.example.com but not example.com. Add both if you need both.
• Omitting ports means port 443 only. Plain http:// on port 80 needs "ports": [80, 443].
• An unknown action value is treated as deny. Use exactly allow, deny or escalate.
• Order matters. A broad deny placed before a specific allow wins.
• Methods. A rule with "methods": ["GET"] does not match a POST, and never matches an HTTPS site, which is checked as CONNECT. The request falls through to the next rule, then to the default. Remove methods from rules for HTTPS sites.
• Redirects and CDNs. Allow the host the download is redirected to as well.

To let the user decide case by case, use "action": "escalate".

Internal and private addresses

Levee refuses any destination that resolves to a private, loopback, link-local or other reserved address (for example 10.x.x.x, 172.16.x.x to 172.31.x.x, 192.168.x.x, 127.0.0.1, and their IPv6 equivalents), even when a rule allows the host name. This is not configurable.

HTTPS on a non-standard port

HTTPS through Levee is only possible on port 443. A service on https://host:8443 cannot be reached from the sandbox, whatever the policy says. Publish the service on 443.

Certificate errors after enabling inspection

If a rule has "inspect": true, Levee decrypts and inspects that host's HTTPS traffic using a certificate authority that exists only for the sandbox session. Standard tools trust it automatically. Tools that pin a server certificate, or that ship their own certificate store and ignore SSL_CERT_FILE and NODE_EXTRA_CA_CERTS, fail with a certificate or TLS error. Turn inspection off for that host ("inspect": false), or configure the tool to use the system certificate store.

Corporate proxy on the host

Levee sends allowed traffic through the host's system proxy settings. If your corporate proxy requires authentication, or refuses the connection, the agent sees Access denied. (or 502 Bad Gateway for an upstream proxy authentication challenge). Allow the destination on your corporate proxy without interactive authentication for the machine, or bypass the proxy for it. After changing proxy or PAC settings on the host, restart the project so Levee picks up the change.

Remembered approvals

Since 0.58.3, remembered approvals are kept by the Levee service in a SYSTEM-only approvals folder and are bound to the project directory and the user who started the project. A record for another directory or user is not used.

"Access is denied" when the app starts

Before 0.58.1, the installed app failed at start with E_ACCESSDENIED for every user who is not a local administrator, because WebView2 tried to create its data folder under Program Files. Since 0.58.1 the app keeps that data in %LOCALAPPDATA%\Vediram\Levee\WebView2. Deploy 0.58.1 or later.

Before you open a request

Send the http.denied audit entries and the proxy.http log. See Collecting logs for support.