A host allow and a kit HTTP rule on api.github.com
Two columns. On the left, the default-code-and-containers group of the balanced preset allows github.com:443 and every subdomain, so a POST to api.github.com /repos/o/r/issues carrying data in its body is allowed, because a host rule reads host and port only. On the right, a network-policy@2 deny entry with hosts api.github.com and methods DELETE blocks DELETE /repos/o/r while the same POST still passes, because deny wins only where the method matches.
A · HOST ALLOW, BALANCED PRESET
B · KIT HTTP RULE, NETWORK-POLICY@2
default-code-and-containers
github.com:443 · **.github.com:443
allow · net:connect:tcp
POST api.github.com /repos/o/r/issues
body: your data
allowed: any method, path, body
a host rule reads host and port only
runtime.deny entry
hosts: [api.github.com]
methods: [DELETE]
DELETE api.github.com /repos/o/r
blocked by the HTTP rule
POST /repos/o/r/issues still passes
deny wins only where it matches