Local, BYOK, and cloud trust boundary

Fail-closed egress separation enforced by each implemented route: CLI local mode makes no network call to us, BYOK traffic goes straight to the provider you configured, and managed cloud is metered against your plan.

Canonical security policy published on our security page, naming the trust-boundary model and its known gaps.