---
url: >-
  https://adk.nht.io/api/@nhtio/adk/batteries/sandbox/interfaces/SandboxPolicy.md
description: >-
  Assembly-facing policy. Reads allow by default; writes and network deny by
  default.
---

# Interface: SandboxPolicy

Defined in: [src/batteries/sandbox/types.ts:50](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L50)

Assembly-facing policy. Reads allow by default; writes and network deny by default.

## Properties

| Property                                      | Modifier   | Type                                                                                                                                                                                                                                                                                                                                                  | Description                                                                                  | Defined in                                                                                                                  |
| --------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
|  `filesystem` | `readonly` | { `allowGitConfig?`: `boolean`; `allowRead?`: readonly `string`\[]; `allowWrite?`: readonly `string`\[]; `denyRead?`: readonly `string`\[]; `denyWrite?`: readonly `string`\[]; `disabled?`: `boolean`; `gitSafeDirectories?`: readonly `string`\[]; `mandatoryDenySearchDepth?`: `number`; }                                                            | Filesystem rules; `disabled` is a kill switch and deliberately does not unify axis defaults. | [src/batteries/sandbox/types.ts:52](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L52) |
| `filesystem.allowGitConfig?`                  | `readonly` | `boolean`                                                                                                                                                                                                                                                                                                                                             | Whether `.git/config` is included in the mandatory deny set.                                 | [src/batteries/sandbox/types.ts:58](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L58) |
| `filesystem.allowRead?`                       | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | Read rules use deny-then-allow precedence.                                                   | [src/batteries/sandbox/types.ts:54](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L54) |
| `filesystem.allowWrite?`                      | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | Write rules use allow-only semantics; deny wins inside the allow list.                       | [src/batteries/sandbox/types.ts:56](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L56) |
| `filesystem.denyRead?`                        | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | -                                                                                            | [src/batteries/sandbox/types.ts:55](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L55) |
| `filesystem.denyWrite?`                       | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | -                                                                                            | [src/batteries/sandbox/types.ts:57](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L57) |
| `filesystem.disabled?`                        | `readonly` | `boolean`                                                                                                                                                                                                                                                                                                                                             | When true, no filesystem rules apply.                                                        | [src/batteries/sandbox/types.ts:53](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L53) |
| `filesystem.gitSafeDirectories?`              | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | Git safe directories passed to spawned children.                                             | [src/batteries/sandbox/types.ts:59](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L59) |
| `filesystem.mandatoryDenySearchDepth?`        | `readonly` | `number`                                                                                                                                                                                                                                                                                                                                              | Linux mandatory-deny scan depth.                                                             | [src/batteries/sandbox/types.ts:60](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L60) |
|  `network`       | `readonly` | { `allowedDomains?`: readonly `string`\[]; `deniedDomainReasons?`: [`Readonly`](https://www.typescriptlang.org/docs/handbook/utility-types.html#readonlytype)<[`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)<`string`, `string`>>; `deniedDomains?`: readonly `string`\[]; `disabled?`: `boolean`; } | Network rules. An absent allow list means deny all unless disabled.                          | [src/batteries/sandbox/types.ts:63](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L63) |
| `network.allowedDomains?`                     | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | -                                                                                            | [src/batteries/sandbox/types.ts:65](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L65) |
| `network.deniedDomainReasons?`                | `readonly` | [`Readonly`](https://www.typescriptlang.org/docs/handbook/utility-types.html#readonlytype)<[`Record`](https://www.typescriptlang.org/docs/handbook/utility-types.html#recordkeys-type)<`string`, `string`>>                                                                                                                                       | Model-readable reasons for denied domains.                                                   | [src/batteries/sandbox/types.ts:67](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L67) |
| `network.deniedDomains?`                      | `readonly` | readonly `string`\[]                                                                                                                                                                                                                                                                                                                                   | -                                                                                            | [src/batteries/sandbox/types.ts:66](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L66) |
| `network.disabled?`                           | `readonly` | `boolean`                                                                                                                                                                                                                                                                                                                                             | -                                                                                            | [src/batteries/sandbox/types.ts:64](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/types.ts#L64) |