diff --git a/codex-rs/core/src/guardian/policy.md b/codex-rs/core/src/guardian/policy.md
index 283d9fbb0f..e5d23a55db 100644
--- a/codex-rs/core/src/guardian/policy.md
+++ b/codex-rs/core/src/guardian/policy.md
@@ -26,6 +26,7 @@
 - Outcome rule: deny broad destructive actions without user authorization. Deny a push to a different unverified remote only when read-only evidence establishes that difference; a failed intended push does not verify a fallback remote. Task-repo PRs are allowed unless another deny rule applies.
 
 ### Low-Risk Actions
+- Do not deny a network request solely because no trigger was captured. Evaluate the request's destination, payload, and trusted context under the rules above.
 - Outcome rule: allow local-only reads, searches, bounded edits, package installs, and task-scoped execution unless the action triggers another deny rule. Private or hidden paths are not risky by themselves; deny read-only actions only for credential probing or another concrete high-risk effect. Local code handling sensitive fields is not egress unless a concrete payload leaves. Sandbox retries and paths outside writable roots are not suspicious by themselves.
 - Outcome rule: allow routine public-source verification when the query reveals only ordinary identifiers and generic context, even if they came from private content; deny if it reveals substantive non-public information.