What no policy can open

Some destinations are refused no matter what any policy says. This is a floor, not a default: there is no rule you can write and no setting you can flip that opens it, and a policy that tries is refused when it loads.

What the floor protects, and why each one is on it:

• the cloud metadata endpoint (169.254.169.254, and the whole 169.254.0.0/16 link-local range it sits inside). Reaching it hands over the machine's own cloud credentials. This is the single highest-value destination on any cloud runner, and it is why the floor exists.
• loopback — the machine's own services, including this engine's own.
• private networks — the RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), carrier-grade NAT, and the IPv6 equivalents. Your internal estate is not reachable from a run by accident.
• the proxy's own socket — so a run cannot loop back through the judge.
• multicast, broadcast, and the named reserved IPv4 ranges — nothing legitimate for a run is there, and each is a way to make an address mean something other than it looks like. This is a list of ranges, not the category "reserved": the equivalent IPv6 space is largely not on the floor, and §9 says so.

Two properties that make this floor worth the name:

It is checked in two places, not trusted in one. A policy rule naming a floor address is refused when the policy loads, and the address a hostname resolves to is checked against the floor before anything is dialled. Either check alone leaves the other door open: a rule can name a hostname that resolves into the floor, and a resolved address can be checked while a literal rule walks past it.

Alternative spellings of a floor address are covered, with one exception. 169.254.169.254 can be written as a single decimal number, in octal, in hexadecimal, or dressed up in half a dozen IPv6 transition formats. The decimal, octal and hexadecimal forms reduce to the same address before the floor is consulted, and the IPv6 transition formats that carry an IPv4 address under a standardised prefix are on the floor as whole ranges in their own right. A v4 address carried under a prefix an operator chose is not on the floor — §9 names it as a limit.

⚠ The floor is a deny list, it is enumerative, and it has a known gap. That has a direction of failure and §9 states it, because it is the sentence a security officer needs and no other section carries it.

---