Block mode keeps the gateway. The PHI container needs the flag too.

Your practice-management product runs one container per clinic. The clinic's contract says PHI goes to no AI vendor without a BAA. You have no BAA with the model providers.

PUT /api/v1/containers/{id}/network with type: block removes the clinic container's internet: but the docs are precise: platform services, including the AI gateway, stay reachable on their own paths. A blocked container can still talk to a model.

So every clinic container is created with ai: false. The flag lives on the platform side of the container, not in anything the workload runs. Audit is a list: GET /api/v1/containers, read the ai field on every tenant.

Two switches, both on the host, both outside the workload's reach. The BAA question stops being a policy engineers follow and becomes a field an auditor can read.