diff --git a/svc/egress.go b/svc/egress.go
new file mode 100644
index 0000000..f1dbb99
--- /dev/null
+++ b/svc/egress.go
@@ -0,0 +1,4 @@
+package svc
+
+// PostEgress proves the pipeline still reaches R2 with policy drop on output.
+func PostEgress() string { return Verify("egress") }