ADR-0121: Egress guard as the only outbound path

• Status: accepted
• Date: 2026-10-30
• French version: ../ADR-0121-egress.md

Context

Kit sections 2.2 and 7.

Decision

Every tenant URL goes through eai.security.egress: DNS resolved at connect time (anti rebinding), redirects never followed, environment proxies ignored, private networks through EAI_EGRESS_PRIVATE_ALLOWLIST, cloud metadata blocked.

Consequences

A test checks the wiring of every outbound client.

Evidence

• services/control-plane/src/eai/security/egress.py
• services/control-plane/tests/test_security_egress.py
• services/control-plane/tests/test_security_egress_wiring.py
• .navin/continuity/DECISIONS.md (Securite)