One extra failure-injection case for the deny-by-default check: run the same blocked-destination probe from each execution context an agent can launch (agent process, shell child, browser or tool worker), then verify they all hit the intended egress policy. Include run and tool identity with the destination and block decision so an alert tells an operator which run to stop. I haven’t performed this audit myself; I work on Orke at BOMTOBE, an agent workspace, so this is a test suggestion, not a claim about any setup.