diff --git a/doc/run.md b/doc/run.md
index 86f27fd13..9029cf250 100644
--- a/doc/run.md
+++ b/doc/run.md
@@ -1180,13 +1180,20 @@ message.
 Without `--net`, the sandbox has no network device, and the other network
 options are refused. With it, an omitted option takes OpenVMM's default:
 egress allowed, ingress denied, and host-loopback access from the workload
-alone, through its gateway. A policy that lets nothing through, egress denied
-without allow rules, ingress denied, and `--host-loopback deny`, attaches no
-network device. Egress rules need an explicit `--network-egress`, as OpenVMM
-requires. Forwards need `--host-loopback allow`; UDP forwards also need egress
-allowed by default and no deny rule that covers the guest network, which
-carries their replies. `--host-loopback allow` needs a guest network prefix of
-`/29` or shorter; see [Host-loopback access](#host-loopback-access).
+alone, through its gateway. A policy attaches no network device when it has
+`--network-egress deny` and `--host-loopback deny`, and no allow rules,
+`--network-ingress allow`, or `--network-proxy`, whatever its deny rules. The
+allow rules of a `--network-egress-policy-file` are the native rules that it
+compiles to, so a file whose allow rules all except their whole destinations
+compiles to none. Any other policy attaches a network device, even one that
+lets nothing through, such as one whose `--network-egress-deny 192.0.2.0/24`
+covers its `--network-egress-allow 192.0.2.1`. In the typed policy of the NVX
+Rust API, every allow rule counts, even one that lowers to no OpenVMM rule.
+Egress rules need an explicit `--network-egress`, as OpenVMM requires. Forwards
+need `--host-loopback allow`; UDP forwards also need egress allowed by default
+and no deny rule that covers the guest network, which carries their replies.
+`--host-loopback allow` needs a guest network prefix of `/29` or shorter; see
+[Host-loopback access](#host-loopback-access).
 
 #### Proxy-only networking
 
@@ -1237,10 +1244,12 @@ refuses, before launch:
   proxy, and a proxy that is not at the gateway, which OpenVMM refused as it
   started.
 
-A policy that lets nothing through now attaches no network device, where
-OpenVMM attached one that carried nothing. `start` refuses a sandbox that an
-earlier release provisioned, whose configuration records the network options
-rather than the typed policy; deprovision it and provision it again.
+A policy with `--network-egress deny` and `--host-loopback deny`, and no allow
+rules, `--network-ingress allow`, or `--network-proxy`, now attaches no network
+device, where OpenVMM attached one that carried nothing. `start` refuses a
+sandbox that an earlier release provisioned, whose configuration records the
+network options rather than the typed policy; deprovision it and provision it
+again.
 
 The explicit `test-microvm --scenario sandbox-proxy-only --backend BACKEND`
 scenario is the acceptance for proxy-only networking. Like the
diff --git a/doc/usage.md b/doc/usage.md
index 6c27549df..cec2afab6 100644
--- a/doc/usage.md
+++ b/doc/usage.md
@@ -301,7 +301,7 @@ do, and their names cannot be abbreviated either.
 | `--mount-allow HOST_PATH` | none | Expose one existing file or directory inside a `--mount-deny` path of the same share again, for example a readable `mcp-payloads` directory inside hidden logs. The hidden directories on the way list only the entries that lead to it, and the workload cannot modify them. Relative paths are resolved inside the share; with several shares, it applies to the `--mount` before it. Repeat to allow multiple paths. See [Access policy](run.md#access-policy). |
 | `--mount-write HOST_PATH` | none | Make one existing file or directory one of the only writable parts of an `rw` share; the workload's writes anywhere else in the share fail with `EROFS`. Relative paths are resolved inside the share; with several shares, it applies to the `--mount` before it, which must be `rw`. Repeat to declare multiple writable paths. `provision` persists the denied, allowed, and writable paths. |
 | `--mount-owner {vmm,caller}` | `vmm` | Select the host identity of the shares' file operations for `run` or `provision`. `vmm` performs them as OpenVMM; `caller` performs them as the workload's UID and GID, squashes guest root to the owner of each shared host directory or file, and fails them with `EPERM` when OpenVMM cannot assume that identity. `caller` requires a Linux host and is persisted by `provision`. See [File ownership](run.md#file-ownership). |
-| `--net IPV4/PREFIX` | none | Enable virtio-net with a static guest address. The guest also gets the IPv6 address that embeds it in `fd00::/96`. The other network options need it. A policy that lets nothing through, `--network-egress deny` without allow rules, with ingress denied and `--host-loopback deny`, attaches no network device. |
+| `--net IPV4/PREFIX` | none | Enable virtio-net with a static guest address. The guest also gets the IPv6 address that embeds it in `fd00::/96`. The other network options need it. A policy with `--network-egress deny` and `--host-loopback deny`, and no allow rules, `--network-ingress allow`, or `--network-proxy`, attaches no network device, whatever its deny rules; a policy file's allow rules are those that it compiles to. Any other policy attaches one, even one that lets nothing through; see [Sandbox networking](run.md#sandbox-networking). |
 | `--network-profile {portable}` | none | Select the required cross-platform network behavior contract; must be specified with `--net`. |
 | `--network-egress {allow,deny}` | `allow` | Set the default guest egress policy for `run` or `provision`. |
 | `--network-ingress {allow,deny}` | `deny` | Set the host ingress policy for `run` or `provision`. `allow` publishes every TCP and UDP port on which the workload listens to clients on the host's private networks, and to the host itself only with `--host-loopback allow`; see [Private-network ingress](run.md#private-network-ingress). |