diff --git a/content/manuals/ai/sandboxes/cloud/move.md b/content/manuals/ai/sandboxes/cloud/move.md
index 2e2f053846..3b0de88b0a 100644
--- a/content/manuals/ai/sandboxes/cloud/move.md
+++ b/content/manuals/ai/sandboxes/cloud/move.md
@@ -72,10 +72,12 @@ appear in the cloud destination. When the source has a workspace, the CLI
 warns and asks for confirmation. The `--force` flag skips the prompt but
 doesn't include those files.
 
-The destination uses cloud network policy. Local network rules don't transfer.
-If the local source has HTTP method or path restrictions, the CLI warns and
-asks for confirmation because those restrictions won't apply in the cloud.
-`--force` skips the prompt but retains the warning.
+The destination uses cloud network policy and the network rules of the
+sandbox's kit, or of its built-in agent, as `sbx --cloud create` does. Network
+rules you added locally don't transfer. If the local source has HTTP method or
+path restrictions, the CLI warns and asks for confirmation because those
+restrictions won't apply in the cloud. `--force` skips the prompt but retains
+the warning.
 
 Published TCP sandbox ports are published on the cloud destination with cloud
 URLs. Ports that the cloud refuses are skipped with a warning. Host port
diff --git a/content/manuals/ai/sandboxes/cloud/network-policy.md b/content/manuals/ai/sandboxes/cloud/network-policy.md
index 2f2f6ab2f3..85cf01026e 100644
--- a/content/manuals/ai/sandboxes/cloud/network-policy.md
+++ b/content/manuals/ai/sandboxes/cloud/network-policy.md
@@ -26,7 +26,8 @@ precedence over allow rules across the applicable policies.
 Cloud creation uses cloud account policy, network rules passed to the command,
 and network access declared by the agent or kit. Both `sbx --cloud create` and
 `sbx --cloud run` leave local network and organization policies on the host.
-Moving a local sandbox to the cloud also uses cloud policy.
+Moving a local sandbox to the cloud works the same way, except that rules you
+added locally don't transfer.
 
 Define the intended policy in the cloud store. After creation, inspect the
 configured rules and [verify connection decisions](#inspect-network-policy).