Function attach 

pub fn attach(endpoint: Option<&EgressTarget>) -> GateOutcome

May a run attach to the person’s browser?

endpoint is the address the person declared for their browser, as the egress classifier read it. None is a building that enabled the tool and has not said where the browser answers, which is the state the person’s next action resolves.

The rule

A declared loopback address is the person’s own machine reached from the person’s own machine: attach. No declaration is a question for the person, not a refusal, because they can answer it. Any other address would read that login state over a network, and the answer there is no.