---
title: Security
description: Sandbox policy, egress allowlists, prompt firewall, PII profiles, and break-glass elevation.
---

The **Security** screen is where operators control execution boundaries: what code can run, what network destinations are allowed, how prompts are filtered, and when temporary elevation is granted.

## Sections

### Sandbox

- **Level** — none, process, container, or stronger isolation modes (container requires Docker on PATH; probe via `runtime.status` before offering the option).
- **Policy** — read/write path allowlists, environment allowlist, and network policy snapshot.
- **Denials** — recent sandbox decisions that blocked an action.
- **Flow preview** — hypothetical decision for a flow/agent combination before dispatch.

The route-only **`sandbox`** screen (see **[Route-only screens](/docs/using-the-app/route-only-screens)**) exposes the same policy shortcuts from workspace runtime sections.

### Egress

- **Policy** — domain allowlist and block-by-default mode (toggle is guarded when the allowlist is empty).
- **Decisions log** — allowed and denied outbound requests.

### Firewall and PII

Prompt firewall rules and custom PII redaction profiles are edited here. Changes take effect for subsequent runs without redeploying agents.

### Break-glass

Time-boxed elevation requests (`access.breakGlass`) for emergencies. Grants and revokes append to the signed audit ledger. Use [Governance](/docs/using-the-app/governance) › Audit for verification.

## MCP operators

External agents connected via `agentskit-os mcp-serve` can read and update firewall, egress, and PII profiles at runtime through MCP security tools — see the [CLI command reference](/docs/cli/command-reference).

## Related screens

| Need | Go to |
|---|---|
| Signed audit trail | [Governance](/docs/using-the-app/governance) |
| Compliance evidence export | [Compliance](/docs/using-the-app/compliance) |
| Tool egress from flows | [Workflows](/docs/using-the-app/flows) run assurance panel |