Comment by ebursztein

There is no direct network access instead all traffic is routed through the security engine that perform network reconstruction, including parsing models and MCP sessions to enforce rules written in a custom DSL based of CEL.