Use the egress blocklist

Governance at the Gateway only helps for traffic that reaches the Gateway. A developer can always point a tool straight at api.openai.com. Your network is where you close that door.

What Sentilai gives you

Policy → Egress blocklist produces a list built from what you have actually configured: your provider endpoints, and the MCP endpoints you have registered. Download it as a text file or copy it.

Because it is generated, it stays in step with your configuration — add a provider and the list changes.

What to do with it

Hand it to whoever runs your egress filtering. The rule you want is roughly:

• Block direct access from developer machines to the AI provider APIs.
• Allow the Sentilai Gateway.

The effect is that the governed path is the only path. A tool that has drifted out of governance stops working visibly, rather than working invisibly ungoverned — which is by far the better failure.

Do it in stages

Blocking provider APIs organization-wide on a Monday morning will break something you did not know existed — a CI job, a data pipeline, someone's script.

Run it in monitor mode first, see what talks directly, decide case by case, then enforce.

The limit

This covers machines on your network. A laptop on a home connection or a phone tether is outside it. Combine egress control with the Non-compliant flag in Diagnostics, which catches drift wherever the machine happens to be.