Data-exfiltration protection on GCP: a VPC Service Controls perimeter encloses BigQuery and Cloud Storage. A VM in an authorized VPC inside the perimeter is allowed access, while a caller outside the perimeter with valid but out-of-perimeter credentials is blocked at the egress boundary. Perimeter interior and exterior are grouped, with the blocked path labeled.