History
- Aug 13, 2026Domains and private resources unified into a single destination field.
Egress rules
Allow or deny outbound traffic by domain, path, method, and port — unmatched means denied.
WhereConsoleCLITerraform
Introduced Jun 3, 2026 · updated Aug 13, 2026
How it works
Precise matches.
Domain, path, method, and port — "*.example.com", "/v1/*", GET and POST on 443. Allow an API's read endpoints without allow-listing the whole host.
Reviewed once, used by a fleet.
Rules are organization-level objects attached to the agents that need them — one reviewed rule serves many agents.
Unmatched means denied.
There is no permissive fallback.
Sandboxes inherit.
A sandbox runs under the rules of the environment it runs — the interactive case is not a loophole.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.