How does it leave your network?

decision 04

A full node connects outbound only, to wss://mesh.agentmesh.ai (WebSocket over 443, the default) or raw NATS on TCP 4222 if you prefer the native protocol. Nothing listens. There is no inbound rule, no load balancer, no public IP and nothing for a scanner to find; a VM with no external address behind Cloud NAT is the intended shape, and it is the same pattern as the build runners your network team already lets out to GitHub.

One item deserves a real review: under VPC Service Controls this is a long-lived connection from inside your perimeter to a third-party service, a documented perimeter decision rather than a config tweak. Decision 06 lists what crosses the wire so the review reads facts rather than guesses.

default VPC, no egress policy Nothing to do. 443 egress is open; the WebSocket default just works.

deny-by-default egress One allowlist entry: mesh.agentmesh.ai on 443 (or 4222). Private VM + Cloud NAT is fine.

TLS-inspecting proxy on 443 Prefer TCP 4222, which does not pass through the proxy, or exempt the host: long-lived WebSockets through inspection proxies drop in ways that are miserable to debug.

VPC service controls Plan a perimeter review. Bring the what-leaves-the-network list from the observability section; it is written for exactly this meeting.