Team admin here. Network Access Policy set to “Defaults + team allowlist” (locked). UI shows the mode selector but no editor to add domains — not on Team Settings → Security, not on the Cloud Agents page.
“an allowlist configuration section appears below the setting where you can add your custom domains”
Nothing appears. Same page also says the team allowlist is shared with the “sandbox default network allowlist” — can’t find that editor either.
Concrete need: add cdn.sheetjs.com so Cloud Agent npm install can fetch xlsx (SheetJS hosts on their own CDN). Currently fails with ECONNRESET at TLS handshake, consistent with egress block for non-allowlisted hosts.
Hey Pierre! thanks for the clear writeup, and apologies for the dead-end UI. You’re right on both counts: the editor genuinely isn’t there, and the ECONNRESET is the expected symptom of egress being blocked for non-allowlisted hosts.
Here’s what’s going on: the “Defaults + team allowlist” option is showing in the Cloud Agents Network Access Policy dropdown, but the domain editor that’s meant to appear below it is currently an Enterprise-plan feature. On self-serve Team plans, selecting that mode leaves nowhere to actually add domains. This is a known bug on our side — we’re tracking the issue and working to resolve it and clarify it our docs.
Thanks for the speedy response Kevin. Feels to me like it’ll be tough for a lot of teams on the teams plan to use cloud agents without a team allowlist, given the dangers of the full bypass. Looking forward to your upcoming guidance in docs here.
? We’d love to start using the cloud agents but this is really quite a blocker