kestrelfield

Thanks, that is a good addition. The egress check in the post only proves the policy once, from the agent process; your version proves it from each place an agent can actually make a call, which is where the gap would hide. I would add one thing: run the probe on every deploy, not only in the audit, so a change to the tool worker's network settings shows up the same day. Agreed on the alert fields too: run id, tool id, destination and decision, or the operator cannot tell which run to stop.