{"version":"2.1.248","anchor":"sandbox-permission-answers-are-matched-to-the-machine-that-a","canonical_anchor":"sandbox-permission-answers-are-matched-to-the-machine-that-a","heading":"Sandbox permission answers are matched to the machine that asked","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/sandbox-permission-answers-are-matched-to-the-machine-that-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Sandbox permission answers are matched to the machine that asked\n\nSandbox permission answers must come back from the same machine that asked.\n\n**What**\n\nWhen a sandboxed agent asks for a permission decision, the code that collects answers now checks that the answer came back for the same host that made the request, not just the same request id. A mismatched answer is refused and logged. Always on.\n\n**Details**\n\n- Previously only the request id was compared, so an answer produced on another machine could be applied.\n- Hardening only; there is no flag and no behaviour change when everything matches.\n\n**Evidence**\n\n`answered for a different host`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}