Policy
The one parser: how a configuration becomes the specification every layer reads.
Filesystem
The layer that turns path sets into Landlock rules and runs the command.
Network
The connect guard, the two HAProxy roles and the Landlock port rules, and how they compose.
Timeout
The layer that bounds a run in wall-clock time, and the contract for deciding that it did.
Resources
The layer that sets the rlimits, and the reason it is started where it is.