If true, allows devbox egress to the agent gateway for credential proxying.
If true, all egress traffic is allowed and other fields are ignored. Used for ALLOW_ALL policies.
If true, allows traffic between the account's own devboxes via tunnels.
If true, allows devbox egress to the MCP hub for MCP server access.
If true, allows devbox egress to Runloop's package/image registry mirrors. Implicitly allowed when allow_all is true.
CIDR-based allow list with optional port restrictions, additive with allowed_hostnames.
DNS-based allow list with wildcard support. Examples: ['github.com', '*.npmjs.org', 'api.openai.com']. Empty list with allow_all=false means no network access (DENY_ALL behavior).
The egress rules for this policy.