There is no direct network access instead all traffic is routed through the security engine that perform network reconstruction, including parsing models and MCP sessions to enforce rules written in a custom DSL based of CEL.