Configure sandbox network policies
Sandbox network policies control outbound network access for digital employees in STAROps. By default, each digital employee runs inside an isolated sandbox that blocks all outbound connections. To allow a digital employee to call external APIs, access databases, or pull internet resources, configure a network policy with domain allowlists, IP/CIDR allowlists, or full public internet access.
You can configure a network policy when you Create a Digital Employee, or add or modify the policy on the details page for an existing one.
Configure a network policy during digital employee creation
Before you begin, ensure that you have:
A STAROps account with access to the STAROps console.
Permissions to create or edit digital employees. For more information, see Digital employee permission configuration.
The target domain names or IP address ranges that the digital employee needs to access.
Log on to the STAROps console.
In the left-side navigation pane, click Digital employee.
Click Create Digital Employee.
On the creation page, configure the basic information such as the ID, name, and RAM role.
In the Sandbox network policy section, turn on Outbound access.
Configure the following parameters as needed. For more information, see Parameters.
In the Allowed FQDNs field, enter the domain names that the digital employee is allowed to access. Enter one domain name per line.
In the Allowed CIDRs/IPs field, enter the IP addresses or CIDR blocks that the digital employee is allowed to access. Enter one address per line.
Confirm the configuration and click OK.
The digital employee is created with the configured network policy.
If you do not configure a network policy during creation, the digital employee uses the default isolation policy and can only access the platform infrastructure. You can add a network policy at any time after creation.
Modify the network policy of an existing digital employee
You can add or modify the network policy of an existing digital employee from the details page. For more information about managing digital employees, see View and edit digital employees.
Log on to the STAROps console.
In the left-side navigation pane, click Digital employee.
In the digital employee list, find the target digital employee and click its name to go to the details page.
Click the Settings tab. In the Sandbox network policy section, make sure Outbound access is turned on.
Configure the following parameters as needed. For more information, see Parameters.
In the Allowed FQDNs field, enter the domain names that the digital employee is allowed to access. Enter one domain name per line.
In the Allowed CIDRs/IPs field, enter the IP addresses or CIDR blocks that the digital employee is allowed to access. Enter one address per line.
Click OK.
The updated network policy is saved and typically takes effect within seconds. If the policy does not take effect, see FAQs.
Delete a network policy
To remove the network policy of a digital employee and restore the default isolation state, perform the following steps:
Log on to the STAROps console.
In the left-side navigation pane, click Digital employee.
In the digital employee list, find the target digital employee and click its name to go to the details page.
Click the Settings tab.
In the Sandbox network policy section, turn off Outbound access.
Click OK.
Outbound network access is disabled and the digital employee reverts to the default isolation policy.
After you delete the network policy, the digital employee can no longer access the external services in the previous allowlist. If running tasks depend on these external services, the tasks may fail.
Parameters
Parameter | Required | Description |
Outbound access | Yes | Turn on to configure domain and IP allowlists. When turned off, the default isolation policy applies. |
Allowed FQDNs | No | A list of exact domain names that the digital employee is allowed to access. Only full domain name format is supported (for example, |
Allowed CIDRs/IPs | No | A list of IPv4 addresses or CIDR blocks that the digital employee is allowed to access. CIDR format (for example, |
You must configure at least one of the Allowed FQDNs or Allowed CIDRs/IPs fields. If both fields are empty when the toggle is turned on, an error is reported when you save the configuration.
Domain allowlist format examples
Input | Valid | Description |
| Yes | Exact domain name. Automatically converted to lowercase after saving. |
| Yes | The system automatically processes it as |
| No | Wildcards are not supported. |
| No | URL format is not supported. Enter only the domain name. |
| No | Port numbers are not supported. |
| No | Single-segment names are not supported. |
IP allowlist format examples
Input | Valid | Description |
| Yes | CIDR format. |
| Yes | Exact IP address format. |
| Yes | Allows access to the entire public internet. |
| No | IPv6 addresses are not supported. |
| No | Invalid IPv4 address. |
FAQs
The network policy is saved but does not take effect
Symptom: The network policy is saved on the console, but the digital employee still cannot access the domains or IP addresses in the allowlist.
Cause: The policy failed to be delivered to the sandbox cluster. This may be caused by network connectivity issues or temporary cluster unavailability.
Solution:
Wait 1 to 2 minutes and try again. The system automatically retries policy delivery.
If the issue persists, go to the digital employee details page and click OK again to trigger policy delivery.
If the issue is still not resolved, contact technical support and provide the digital employee ID.
DNS resolution fails for a domain in the allowlist
Symptom: A domain is configured in the allowlist, but the digital employee reports a DNS resolution failure when accessing the domain.
Cause: The network policy controls outbound network connections. DNS resolution is allowed by default. This issue is typically caused by a nonexistent domain or missing DNS records.
Solution: Verify that the domain name is correct and that the DNS records for the target domain are properly configured.
Difference between 0.0.0.0/0 and domain allowlists
Specifying
0.0.0.0/0in the IP allowlist allows the digital employee to access all public IP addresses. This is suitable when the digital employee needs to access a large number of undetermined external services.Domain allowlists provide fine-grained control over the target services that the digital employee can access, allowing only the necessary network connections.
If you can identify the specific services that the digital employee needs to access, use domain allowlists or IP allowlists instead of 0.0.0.0/0 to minimize network exposure.