A WireGuard VPN is available for accessing data sources behind private networks. The VPN uses a network namespace, so it is completely isolated. To run any command through the VPN, prefix it with `vpn-exec`: ```bash vpn-exec curl https://internal.client-db.example.com vpn-exec psql -h 10.0.1.5 -U analyst -d warehouse ``` Rules: - Use `vpn-exec` only when needed. Most tasks don't require VPN. - Do not use `wg-quick up/down` — that would affect the entire system. When working with client data — any data source, database, warehouse, or external system that belongs to a Gemma client — the following rules are non-negotiable: 1. Bedrock required. You must be running on AWS Bedrock (provider = `bedrock`) before accessing any client data source — this ensures data processing stays within compliant infrastructure. 2. VPN required. All client data access must go through `vpn-exec` — direct connections bypass network namespace isolation. 3. When in doubt, ask. If you are unsure whether a data source is a client system, ask the user before proceeding.