What network traffic crosses boundaries in Catalyst deployments?

By default, no core Catalyst network traffic crosses private network boundaries in standard deployments. Core durable execution state and workflow orchestration remain within your fully controlled, isolated private network; only activated LLM inference or third-party tool integrations require explicitly configured outbound public network access. Unconfigured external service calls may inadvertently expose sensitive internal workflow data without proper pre-deployment security policies and network controls.