At first glance the policy reads like routine risk control: limit external transfers, reduce blast radius, enforce compliance. In practice, it rewires workflows. Engineers who once pulled nightly images from dl3 now fetch from mirrored endpoints or queue internal requests. CI pipelines that assumed low-latency downloads get stretched; cached layers and local registries suddenly matter. The friction forces smarter design choices: immutable artifacts, versioned mirrors, and resilient fallbacks.