Inspection limits

Patronus inspects supported encrypted AI traffic through its local mitmproxy CA. When reliable inspection is not possible, Patronus records the reason and passes the traffic through instead of breaking the application.

This fail-open bypass preserves compatibility, but the request is not inspected.

Why traffic can become ineligible

Traffic can become ineligible for inspection when:

• the client application rejects the local mitmproxy CA,
• the client uses certificate pinning or a private trust store,
• the client closes the TLS handshake after Patronus presents an inspection certificate,
• the communication protocol is not one Patronus can safely process,
• the observed connection lacks enough host or SNI information to inspect safely.

When Patronus sees client TLS failures such as unknown ca, bad certificate, certificate unknown, or an early connection close, it records the compatibility problem for that application and connection.

What happens next

After an inspection failure is recorded, matching traffic is treated as tls_pass_through instead of inspectable_tls.

The bypass key includes:

Field	Meaning
App ID	The application associated with the connection, or unknown.
Source context	The capture context that observed the connection.
Host or SNI	The destination host used for TLS inspection decisions.
Port	Usually 443, unless another destination port is observed.
Protocol	Usually tcp.

Patronus keeps the first seen time, last seen time, hit count, reason, and evidence for the bypass entry.

Where to see it

In the desktop app, open Settings → Whitelisted to see bypassed entries.

The list shows apps and destinations Patronus could not inspect. A whitelisted entry is not trusted; Patronus passed it through because inspection would break or mishandle the traffic.

Common reasons

Reason	Meaning
client_rejected_patronus_ca	The client did not accept the local mitmproxy CA during TLS inspection.
client_tls_handshake_failed	Patronus observed the TLS handshake fail while attempting inspection.

If a runtime should be inspectable but appears under Whitelisted, check the runtime CA settings first. For Node, Python, curl, pip, and Docker, see Runtime CA Support.