diff --git a/agent.py b/agent.py
index 4350192..fcca3ef 100644
--- a/agent.py
+++ b/agent.py
@@ -659,6 +659,19 @@ def _now() -> str:
     return datetime.now(UTC).isoformat()
 
 
+def _effective_dry_run(agent: CustomerIntegrationEngineer, *values: bool) -> bool:
+    return bool(agent.config.default_dry_run or any(values))
+
+
+def _live_network_unavailable_reason(agent: CustomerIntegrationEngineer) -> str | None:
+    if getattr(agent.egress, "deny_internet_by_default", False):
+        return (
+            "live network checks are disabled by this runtime because egress denies internet by default; "
+            "acceptance can validate metadata in dry_run mode but cannot contact external endpoints"
+        )
+    return None
+
+
 def _audit(action: str, integration_id: str, details: dict[str, Any] | None = None) -> AuditEntry:
     return AuditEntry(ts=_now(), action=action, integration_id=integration_id, details=redact_obj(details or {}))