# Outbound network policy modes, audit log and org allowlists > Operators choose open or curated outbound access, every outbound request is audited with its org and session, and admins can widen the allowlist for one org. Source: Date: 2026-10-10 Products: Platform, Cloud, CLI Category: Feature Pull request: everruns/everruns#4432 Pull request: everruns/everruns#4437 Pull request: everruns/everruns#4452 Pull request: everruns/everruns#4476 Pull request: everruns/everruns#4534 Self-hosted deployments set `EVERRUNS_EGRESS_POLICY` to `open`, `curated-writes` or `curated-all`. In `curated-writes`, plain GET and HEAD reads reach public hosts while writes, MCP and integration traffic still need the allowlist; a curated deny list applies first in both curated modes. The system allowlist grew to about 510 host patterns. Every outbound request is logged on the `everruns::egress::audit` target with its decision, host, status, organization and session. A platform administrator can let an organization extend the allowlist with up to 50 host patterns, or grant it open egress. Manage this with `everruns orgs egress-allowlist`. See [Network access](https://everruns.com/docs/advanced/network-access/), the [orgs CLI reference](https://everruns.com/docs/reference/cli/orgs/) and [#4432](https://github.com/everruns/everruns/pull/4432), [#4437](https://github.com/everruns/everruns/pull/4437), [#4452](https://github.com/everruns/everruns/pull/4452), [#4534](https://github.com/everruns/everruns/pull/4534).