This policy describes the architecture as it actually works — one controlled egress, not "data never leaves".