{"version":"2.1.77","anchor":"sandbox-allowread-setting","canonical_anchor":"sandbox-allowread-setting","heading":"Sandbox allowRead Setting","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.77\/e\/sandbox-allowread-setting","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.77","markdown":"### Sandbox `allowRead` Setting\n\n**What**\n\nNew `allowRead` setting lets administrators re-allow specific read paths within broad `denyRead` regions, and a new `allowManagedReadPathsOnly` flag restricts reads to only policy-approved paths.\n\n**Details**\n\n- `allowRead`: array of paths that take precedence over `denyRead`, enabling fine-grained \"deny broad, allow narrow\" patterns\n- `allowManagedReadPathsOnly`: boolean in `policySettings.sandbox.filesystem` \u2014 when true, only managed `allowRead` paths are permitted\n- Glob expansion supported for `allowRead` patterns\n- Logging for re-allowed paths within denied regions\n\n**Evidence**\n\nSettings schema (search for `\"Paths to re-allow reading within denied regions\"`) and policy check (search for `\"allowManagedReadPathsOnly\"`)"}