Commands with allowed_domains now always prompt for approval instead of being auto-allowed
When a tool call is restricted to a sandbox network list and carries allowed_domains under the relevant sandbox mode, Claude Code's permission check now forces the decision to "ask" rather than letting an allow rule or hook approve it silently. The message explains that allow rules and hook approvals cover the command itself but not the specific hosts it's allowed to reach, and that only the auto-mode classifier can approve the allowed_domains list.
This closes a gap where a command could be pre-approved without the specific network hosts it's allowed to contact also being vetted, ensuring host access still goes through the classifier meant to review it.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* Added per-command `allowed_domains` to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refusedchangelog see the edit
Anthropic's documentation has since written up allowed_domains, on Claude Code changelog.