Gateway

The sandbox gateway enforces data-plane policy per sandbox.

• Per-sandbox token — minted as a Secret per sandbox; client presents it to the gateway (see Install — Per-Sandbox Token).
• Egress policy — gateway allowlists hosts/egress per sandbox spec.
• Separation — Imp remains the VM runtime; gateway never bypasses ImpVM/ImpNetwork.

See Sandbox Overview and Install.