apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny-all, namespace: ai }
spec:
    podSelector: {}
    policyTypes: ["Ingress", "Egress"]