Deny when the connector declares egress to a domain outside the allowlist.
Enforcement is declaration-based: it gates the egress surface the manifest
claims, guarding against misconfiguration and org-policy drift — not
against a connector that lies about what it calls. The runtime half is
egressFetch (connector SDK).
Deny when the connector declares egress to a domain outside the allowlist.
Enforcement is declaration-based: it gates the egress surface the manifest claims, guarding against misconfiguration and org-policy drift — not against a connector that lies about what it calls. The runtime half is
egressFetch(connector SDK).