Expand description
Native outbound-network policy for agent-controlled requests.
The policy is evaluated at the shared tool registry before built-in, MCP,
or dynamic plugin tools execute. Configured runtime endpoints are validated
separately during application config loading. Redirect-capable HTTP clients
should continue to use url_safety::ssrf_redirect_policy so every hop is
checked as well.