> ## Documentation Index
> Fetch the complete documentation index at: https://hopsdocs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox settings

> Control which hosts a sandbox can reach.

**Sandbox settings** lives under **Workspace security**. These are organization-wide security settings. Everyone in your organization works under them; only admins can change them.

![Sandbox settings with the Allowed domains options Deny all, Allow all and Custom.](https://mintcdn.com/hopsdocs/a37xUXSHrM6N3E5W/images/settings-sandbox.png?fit=max\&auto=format\&n=a37xUXSHrM6N3E5W\&q=85\&s=3b6af296054eadce62a0deee5088d16f)

## Allowed domains

Domains that agents are allowed to access from within a sandbox. This governs the sandbox an agent runs commands in. Agents also have built-in web search, page-reading and image import tools that run outside the sandbox, and this setting does not restrict those.

| Option | Behavior |
| - | - |
| **Deny all** | A sandbox can reach only Hops file storage, so uploads and downloads keep working. No other host. This is the default. |
| **Allow all** | A sandbox can reach any host on the internet. |
| **Custom** | A sandbox can reach Hops file storage and the domains you list. No other host. |

Select **Save** to apply a change, or **Discard changes** to revert.

A saved change applies to a sandbox when it is created or next restarted. A sandbox that is already running keeps the policy it started with.


## Related topics

- [General](/settings/general.md)
- [External sharing settings](/settings/external-sharing.md)
- [Privacy & Security](/settings/privacy-security.md)
- [Custom emojis](/settings/custom-emojis.md)
- [Apps access](/settings/apps-access.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.