Possible change discussed—don't allow virtual addresses to be blocked in a 403 policy (since they don't get checked anyway; only the master does) _Originally posted by @danrobinson in https://github.com/tempoxyz/tempo/pull/2852#discussion_r2893105884_