The contractor's first request is to be locked out

IT welds a contractor's container shut so the contractor can't exfiltrate. You're the contractor, and you ask for the welding yourself.

Before you touch the client's data you send them two rules for your container: POST /firewall/egress, action drop, tcp 1-65535, destination 0.0.0.0/0, with an allow to their Git host ahead of it. The firewall lives on the host; it doesn't care that you're root inside. Your terminal URL still works, because proxy traffic bypasses the firewall. You can work. You can't leave.

Six months later, something leaks. The client's activity log is append-only and records who wrote the rules and when. GET /firewall/rules shows they never came off. "Could the contractor have copied it out" has a documented answer, and the client wrote it.

You didn't ask for trust. You asked for a wall with your name in the description field.