To build on this: a gateway controls where the model request goes, but with coding agents the data often leaves another way. A tool result can include file contents, and then the model can be steered into putting that data into a web fetch URL or a call to some third-party MCP server. That traffic never goes through the gateway, because it starts from the client machine. So the real boundary has to include an egress allowlist on the developer's machine or in its sandbox, not just the model endpoint. I'd be curious whether Consus ships a recommended client-side configuration, or treats that as the customer's job.