A destination grant answers 'may this process open a connection to registry.npmjs.org for the next N minutes?' A merge approval answers a different question. A grant to a package registry does not authorize a git push. A merge approval does not open the public internet.
Fleet grants name a host. An unknown host parks blocked_on_egress without holding a socket. Approvals copy the parked host so a caller cannot swap it after the human has seen the request. Hostname grants that rebind to loopback, link-local, metadata, or RFC1918 are refused at dial time. When the grant expires or is revoked, tracked relays close; new dials are denied.
Missing intercept, iptables, or an unproven grant denies outbound traffic.