# Network access policies


Network access policies control outbound connections from sandboxes. Each
policy contains one or more rules that allow the domains, IP ranges, and ports a
workflow needs, or block destinations that should stay unavailable.

You can configure network access in two places:

- [Local policy](/ai/sandboxes/governance/access-controls/network/local/), which applies to sandboxes on one developer machine
  when organization governance is not active.
- [Organization policies](/ai/sandboxes/governance/access-controls/network/organization/), which apply centrally across an
  organization or to selected teams.

When organization governance is active, organization network rules replace
local rules. Local rules are inactive until organization governance no longer
applies.

## Rule syntax

Network rules use the actions `connect:tcp` and `connect:udp`. Resources are
hostnames, CIDR ranges, ports, or hostnames with ports.

Examples:

- `api.example.com`
- `*.example.com`
- `**.example.com`
- `example.com:443`
- `10.0.0.0/8`

For exact wildcard behavior and CIDR support, see
[Network rules](/ai/sandboxes/governance/concepts/#network-rules).

## Local network rules

Use `sbx policy allow network` and `sbx policy deny network` to manage local
network rules:

```console
$ sbx policy allow network api.example.com
$ sbx policy deny network ads.example.com
```

For presets, sandbox-scoped rules, testing, and troubleshooting, see
[Local policy](/ai/sandboxes/governance/access-controls/network/local/).

## Organization network rules

Organization network rules belong to policies that can apply to the whole
organization or to selected teams. For setup steps and team scoping, see
[Organization policies](/ai/sandboxes/governance/access-controls/network/organization/).

Use [Monitoring policies](/ai/sandboxes/governance/monitor-and-enforce/monitoring/) to inspect
which network rules are active on a developer machine.