{"version":"2.1.317","anchor":"sandbox-network-deny-now-reports-whether-policy-caused-it","canonical_anchor":"sandbox-network-deny-now-reports-whether-policy-caused-it","heading":"Sandbox network blocks now record whether a policy caused them","tier":"internal","area":"Sandbox","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/sandbox-network-deny-now-reports-whether-policy-caused-it","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### Sandbox network blocks now record whether a policy caused them\n\nWhen the sandbox blocks a domain, it now notes whether a policy caused the block and checks both the original and resolved host\n\n**What**\n\nThe sandbox controls which internet domains commands can reach. When it blocks one, it now records whether a policy caused the block. A block caused by `sandbox.network.allowManagedDomainsOnly` is marked as a policy block.\n\nDeny rules are also now checked against two names: the host name as first given and the name it resolves to.\n\n**Why**\n\nClaude Code can now tell policy blocks apart from other blocks. Checking both host names also makes it harder for a request to slip past a deny rule by using a different name.\n\n- Area: Sandbox\n- Names: `sandbox.network.allowManagedDomainsOnly`\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: org\n- Heads-up: no"}