diff --git a/src/devx/tools/check_test_isolation.py b/src/devx/tools/check_test_isolation.py
index 5f13a85..1e19852 100644
--- a/src/devx/tools/check_test_isolation.py
+++ b/src/devx/tools/check_test_isolation.py
@@ -130,6 +130,26 @@ HELPER_INTERNAL_CALLS: dict[str, set[str]] = {
     "run_cmd": {"subprocess"},
 }
 
+# I/O function internal dependencies: if a test patches one of these
+# internal dependencies, the I/O function call is considered safe.
+# Maps I/O function name → set of internal function/method names it calls.
+IO_INTERNAL_CALLS: dict[str, set[str]] = {
+    "get_customer_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
+    "get_observability_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
+    "get_pat": {
+        "_iter_sources",
+        "_local_pat_path",
+        "_secrets_path",
+        "_read_secrets_pat",
+        "validate_pat",
+        "ZitadelAuth",
+        "load_secrets",
+        "os.environ",
+    },
+    "load_secrets": {"load_vault_yaml", "REPO_ROOT", "open", "yaml", "safe_load"},
+    "get_customer_secret": {"load_customer_secrets", "load_vault_yaml", "load_secrets", "REPO_ROOT", "open"},
+}
+
 # subprocess functions that the runtime audit wraps.
 _SUBPROCESS_FUNCS = ("run", "call", "check_call", "check_output", "Popen")
 
@@ -817,6 +837,9 @@ class TestIsolationVisitor(ast.NodeVisitor):
             or sn in all_patches
             or any(io_key in p or sn in p for p in all_patches)
             or any(p.endswith(f".{sn}") for p in all_patches)
+            or any(
+                dep in all_patches or any(dep in p for p in all_patches) for dep in IO_INTERNAL_CALLS.get(io_key, set())
+            )
         ):
             self.violations.append(
                 Violation(