Skip to main content
Admins can control whether an Agent’s Code Execution & File Creation setting can access the internet while it analyzes data, processes files, or creates documents. Use these settings to balance security with the flexibility to install packages or reach approved external domains.
Code Execution & File Creation internet access settings apply to new chats and new code sessions. Existing chats that already have a running session keep their current network access until a new session starts.

​
Availability

Code Execution & File Creation is enabled by default for new custom Agents. You can turn it on or off for an individual Agent from the Agent editor under Customize > Advanced Settings. Organization admins control the internet access policy separately from the Agent-level feature toggle. New organizations start with internet access enabled for package managers and any custom domains you add. Organizations created before this setting was introduced keep their existing all-domain internet access until an admin changes it.

​
Configure network access

1

Open organization settings

Click your account name at the bottom of the sidebar, then click the gear icon next to your organization name.
2

Go to Controls

In Organization Settings, click Controls under the Admin section.
3

Choose whether internet access is enabled

Use Enable internet access to control whether Agent sandboxes can reach the internet at all.Turn this off to block all outbound internet access. Agents can still analyze data, process files, and create documents using pre-installed packages.More restrictive settings reduce risk, but may prevent package installs or external data access that some file and data tasks need.
4

Choose allowed domains

If internet access is enabled, choose one of the allowed domain options:
  • None — Allows only the custom domains you add. If you do not add domains, the sandbox cannot reach external domains.
  • Package managers + custom domains — Allows package install domains plus any domains you add.
  • All domains — Allows unrestricted outbound internet access.
5

Add custom domains if needed

When using None or Package managers + custom domains, add any extra domains your Agents need to reach, such as api.example.com or *.example.com.Click Add after each domain.

​
Choosing a network access level

Start with stricter access when Agents handle sensitive files or should not contact external systems while processing data. Expand access only when a team needs package installs, approved APIs, or company-approved data sources.
  • Internet access off gives the strongest isolation.
  • None allows only the custom domains you add.
  • Package managers + custom domains gives teams controlled flexibility.
  • All domains gives the most flexibility, but carries the highest risk.

​
Important limitations

Network access controls apply to Code Execution & File Creation sessions. They do not control Web Search, web fetch, MCP connectors, or other Connectors.
If you change code execution internet access while testing an Agent, start a new chat before verifying the new behavior.

Code Execution & File Creation

Learn how Agents analyze data, generate files, and process large results.

Enterprise readiness

Review Cassidy security, governance, and admin controls.

Assign roles and groups

Control who can access organization settings.