What
Setting sandbox.network.allowedDomains to an empty array in managed policy no longer derives an empty desktop egress allowlist; the derived value is skipped and a warning tells the admin to either remove the key or list the domains.
Details
- The derivation of
coworkEgressAllowedHostsnow requires the array to be non-empty. Previously the empty array was passed straight through.
Evidence
coworkEgressAllowedHosts
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlesandbox.network.allowedDomains
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.network.allowedDomains, on All settings.
| Lists | Combines entries from every source | [`permissions.allow`](#permissions-allow), [`sandbox.network.allowedDomains`](#sandbox-network-alloweddomains), and other list keys |settings-reference see the edit
Added since
A small documentation edit on Configure server-managed settings touched a line naming sandbox.network.allowedDomains after this was published.
An approval for `sandbox.credentials` or `sandbox.network.tlsTerminate` also covers the [`sandbox.network.allowedDomains`](/docs/en/settings-reference#sandbox-network-alloweddomains) entries in those same delivered settings, because both s…server-managed-settings see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
A small documentation edit on Configure server-managed settings touched a line naming sandbox.network.allowedDomains after this was…