Allow rules such as Slack, Mail, Messages, Signal, WhatsApp, 1Password → local provider only / never cloud; Cursor, Browser, Terminal → selected cloud provider allowed. Ideally with fail-closed behavior: if the local provider is unavailable, do not fall back to cloud for protected apps.
Allow rules such as Slack, Mail, Messages, Signal, WhatsApp, 1Password → local provider only / never cloud; Cursor, Browser, Terminal → selected cloud provider allowed. Ideally with fail-closed behavior: if the local provider is unavailable, do not fall back to cloud for protected apps.