docs: clarify default sandbox network policy

The FAQ did not explicitly state that Open is selected by default for every sandbox type. Clarify that Open permits all outbound destinations and list the options for restricting egress.

Co-Authored-By: Claude <noreply@anthropic.com>

content/manuals/agentic-platform/faq.md

@@ -34,6 +34,10 @@ and collaborative ownership are not part of the initial release.
 
 ## How does a sandbox access external services?
 
+By default, every new sandbox uses the **Open** user policy, regardless of
+sandbox type. **Open** allows access to all outbound destinations. To restrict
+egress, replace **Open** with **Balanced**, a custom policy, or no user policy.
+
 Network policies control the destinations a sandbox can reach. The sandbox
 type's read-only kit policy applies automatically, and you can select zero or
 more user policies when you create the sandbox. If you select no user policies,