egress

  API_KEY:
    source: env
    key: EXAMPLE_API_KEY            # SLOT: the OS env var holding the key
    egress:
      - to: "nika:fetch"            # the send · default-deny otherwise
      - to: "outputs"               # the return value derives from the authed response

permits:                            # the blast radius · default-deny once present
  tools: ["nika:fetch"]
  # `egress:` above sanctions the FLOW (this secret may ride a fetch); it does