egress control

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

A gateway is the one place every tool call passes, which makes it the natural home for policy. It is also blind to everything that does not pass through it, and that is the half of the answer most candidates skip.