A host computer configured to operate on at least one network, the host computer being configured to execute an endpoint agent configured to gate network connections, wherein the endpoint agent is configured to, for a respective network connection: obtain metadata for the network connection; determine whether the obtained metadata matches a rule in a rules cache maintained by the endpoint agent; in response to determining that the obtained metadata does not match a rule in the rules cache, send a connection escalation request containing the obtained metadata to a controller executed by a server computer in network communication with the endpoint agent; hold the network connection, preventing the passage of data, pending a response from the controller; receive the response from the controller including an action for handling the network connection; cache, in the rules cache, for future use, a rule including the action received from the controller; and handle the network connection in accordance with the action, and wherein the controller is configured to: maintain a plurality of rules that specify actions for handling network connections based on obtained metadata, receive connection escalation requests from endpoint agents, match metadata received in the connection escalation requests with rules from the plurality of rules, and reply to the connection escalation requests with responses including actions for handling network connections based on the matched rules. wherein the endpoint agent is configured to, for a respective network connection: obtain metadata for the network connection; determine whether the obtained metadata matches a rule in a rules cache maintained by the endpoint agent; in response to determining that the obtained metadata does not match a rule in the rules cache, send a connection escalation request containing the obtained metadata to a controller executed by a server computer in network communication with the endpoint agent; hold the network connection, preventing the passage of data, pending a response from the controller; receive the response from the controller including an action for handling the network connection; cache, in the rules cache, for future use, a rule including the action received from the controller; and handle the network connection in accordance with the action, and obtain metadata for the network connection; determine whether the obtained metadata matches a rule in a rules cache maintained by the endpoint agent; in response to determining that the obtained metadata does not match a rule in the rules cache, send a connection escalation request containing the obtained metadata to a controller executed by a server computer in network communication with the endpoint agent; hold the network connection, preventing the passage of data, pending a response from the controller; receive the response from the controller including an action for handling the network connection; cache, in the rules cache, for future use, a rule including the action received from the controller; and handle the network connection in accordance with the action, and wherein the controller is configured to: maintain a plurality of rules that specify actions for handling network connections based on obtained metadata, receive connection escalation requests from endpoint agents, match metadata received in the connection escalation requests with rules from the plurality of rules, and reply to the connection escalation requests with responses including actions for handling network connections based on the matched rules. maintain a plurality of rules that specify actions for handling network connections based on obtained metadata, receive connection escalation requests from endpoint agents, match metadata received in the connection escalation requests with rules from the plurality of rules, and reply to the connection escalation requests with responses including actions for handling network connections based on the matched rules.