Org-wide gate that runs at sign-in and on every privileged request. Block or allow by IP / CIDR, country/region, email domain, or phone country. Evaluated edge-side before PURE loads — pairs with per-agent Travel Permissions and the device limits in Security.