From a0e699f3f96e122915ba1858bb97db9bd1d664e4 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Wed, 2 Sep 2026 10:11:35 +0000 Subject: [PATCH] docs: clarify default sandbox network policy The FAQ did not explicitly state that Open is selected by default for every sandbox type. Clarify that Open permits all outbound destinations and list the options for restricting egress. Co-Authored-By: Claude --- content/manuals/agentic-platform/faq.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/manuals/agentic-platform/faq.md b/content/manuals/agentic-platform/faq.md index e40da49e82..6f32f40bd1 100644 --- a/content/manuals/agentic-platform/faq.md +++ b/content/manuals/agentic-platform/faq.md @@ -34,6 +34,10 @@ and collaborative ownership are not part of the initial release. ## How does a sandbox access external services? +By default, every new sandbox uses the **Open** user policy, regardless of +sandbox type. **Open** allows access to all outbound destinations. To restrict +egress, replace **Open** with **Balanced**, a custom policy, or no user policy. + Network policies control the destinations a sandbox can reach. The sandbox type's read-only kit policy applies automatically, and you can select zero or more user policies when you create the sandbox. If you select no user policies,