Traffic to the model providers the agent declares, and to the Holon gateway itself, is implicitly allowed. Every other host must be named. Reading the list tells you where your input can travel before you call: an agent that declares no egress at all works on what you send it and nothing more.
How strongly the declaration binds depends on how the agent runs. In a container, undeclared egress is blocked and the record says the guarantee is enforced. For an agent the author hosts and Holon calls over the network, the declaration is attested, not enforced, and the record says that too, so you know what you are trusting.
A mandate can set allow_egress: false, and agents that send data elsewhere are then never hired under it.
Example: web-to-text declares the whole public web as egress, since fetching a page is its job. csv-profile declares none: your file goes nowhere.