2 min lesson
Egress control: default-deny by design
Answer "How is an agent's network egress governed in a sandboxed configuration?" Go step by step and end with what you would do.
Step 1 of 3
Egress control: default-deny by design
Sandbox mode turns the network off by default. When an agent does need to reach out, egress is governed the same way model and tool access is - explicit allow, explicit block, deny everything else.
- Allowlist
- Destinations the agent may reach auto-run, without a prompt
- Denylist
- Destinations that are always blocked, no override
- Default
- Deny everything else - anything not explicitly allowed is refused
- Enforcement
- DNS filtering plus an HTTP proxy carry the policy at the network layer, not just in the app
Default-deny egress means a misbehaving or prompt-injected agent has nowhere to send data it shouldn't.
Learn more
Full explanation
Why the controls have to scale with the code
Why the controls have to scale with the code
More agency means more security surface, and that math does not stay small. At NVIDIA-scale - on the order of 40,000 engineers using agents daily - the governance question stops being "is this safe for one developer" and becomes "how do we govern responsibly at scale."
There is a second-order effect to name. When a team ships materially more code, faster, with agents, the controls that gate code - review capacity, policy, access controls - have to scale with that volume. Governance that was sized for human throughput becomes the bottleneck, or worse, the gap. The three layers exist so the boundaries scale as deterministic policy rather than as more manual review.
"The privacy foundation - Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition., ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition., SOC 2, your IdP and MDM - is what gets you to yes on where code goes. On top of that we give you three agent controls: hooks you write and check into the repo, model and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlists down to the individual tool with auto-run or approval per tool, and a sandbox that scopes file access, turns off network by default and makes git read-only. All three are org-enforced. As you ship more code with agents, those boundaries scale as policy, not as more manual review."
If an interviewer asks how you'd govern agents for a 40,000-engineer customer, do not list features. Lead with the principle - more agency is more surface, so controls scale with code - then name the three layers and that each is org-enforced. Closing on egress default-deny (allowlist auto-run, denylist always blocked, everything else refused, via DNS filtering and an HTTP proxy) shows you can govern the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition., not just describe it.