Three kits resolve into one grant set Top: three kits, the captured hello-kit workload with one network-policy@2 allow for example.com, the gh mixin from the specification example with network-policy@1 allows and a GitHub credential, and a mixin that carries the network-policy@2 config example with a bounded allow and two deny entries. Middle: sbx resolves the closed set with exactly one workload. Below: the merged grant set stored in the lock, five rows of allow, deny, install, and credential entries. Bottom: two branches for the next version of a kit. A version whose grants stay inside the stored set applies silently. A version that removes the deny on DELETE widens the set and stops for approval. THE DECLARED KITS hello-kit, workload fixtures/kits/hello-kit network-policy@2, runtime: allow example.com gh, mixin kitspec 2 example network-policy@1 runtime allow github.com, api.github.com, uploads.github.com credential@1: github, runtime, GH_TOKEN proxyManaged bounds, mixin kitcap network-policy@2 config install: registry.npmjs.org runtime: allow api.github.com GET and HEAD on /repos/** deny api.github.com DELETE deny telemetry.example.com sbx resolves the set (kitspec 5.3) closed set, one workload, one provider per name, deny wins the lock records the grant set the merged grant set for the sandbox (kitspec 7.4) runtime allow example.com, github.com, uploads.github.com runtime allow api.github.com, every method and path (bounded entry dropped, kitspec 9.5) runtime deny api.github.com DELETE, telemetry.example.com (deny wins, kitcap) install allow registry.npmjs.org (closed again before the agent starts, kitspec 12) credential github at runtime, GH_TOKEN proxyManaged, inject on api.github.com the next version of a kit stays inside the set a bounded allow on a host already granted applies silently (kitspec 7.4) removes deny api.github.com DELETE a removed deny entry is a widening stops and asks before it applies same grants wider grants A kit grants itself nothing: each row is a request the host answered. The lock judges the next version. From hello-kit/kit.yaml, kitspec 2, 5.3, 7.4 and 9.5, and kitcap network-policy@2 and credential@1.