# Class LittleGhost::Sandbox::NetworkPolicy

Documentation version: Edge

Canonical HTML: https://littleghostai.org/docs/LittleGhost/Sandbox/NetworkPolicy.html

Declares outbound connectivity for sandbox-launched processes. A network
policy does not apply to providers or arbitrary Ruby tools in the host.

## Inheritance

`LittleGhost::Sandbox::NetworkPolicy < Object`

## Attributes

<a id="attribute-i-allow"></a>
### `allow` (R)

Normalized endpoints accepted by an allowlist gateway.

<a id="attribute-i-authorizer"></a>
### `authorizer` (R)

Trusted request authorizer used by HTTP inspection, when supplied.

<a id="attribute-i-forward_headers"></a>
### `forward_headers` (R)

Header names the gateway may pass to an HTTP authorizer.

<a id="attribute-i-gateway"></a>
### `gateway` (R)

Explicit gateway declaration, when supplied.

<a id="attribute-i-inspection"></a>
### `inspection` (R)

Inspection level requested from the gateway.

<a id="attribute-i-mode"></a>
### `mode` (R)

Connectivity mode: `:inherit`, `:none`, or
`:allowlist`.

<a id="attribute-i-mutation_headers"></a>
### `mutation_headers` (R)

Header names an HTTP authorizer may set on an upstream request.

## Class methods

<a id="method-c-coerce"></a>
### `.coerce`

```ruby
.coerce(value)
```

Returns `value` unchanged or converts a mode or Hash to a policy.

<a id="method-c-new"></a>
### `.new`

```ruby
.new(mode:, allow: [], inspection: :connect, gateway: nil, authorizer: nil, forward_headers: [], mutation_headers: [])
```

Builds an outbound policy. Enforcement remains the configured gateway's
responsibility.

## Instance methods

<a id="method-i-3D-3D"></a>
### `#==`

```ruby
#==(other)
```

Policies compare by their normalized enforcement declaration.

<a id="method-i-allowlist-3F"></a>
### `#allowlist?`

```ruby
#allowlist?()
```

Indicates that outbound traffic must pass an allowlist gateway.

<a id="method-i-eql-3F"></a>
### `#eql?`

```ruby
#eql?(other)
```

<a id="method-i-hash"></a>
### `#hash`

```ruby
#hash()
```

Hashes the normalized enforcement declaration.

<a id="method-i-inherit-3F"></a>
### `#inherit?`

```ruby
#inherit?()
```

Indicates unrestricted backend-provided connectivity.

<a id="method-i-none-3F"></a>
### `#none?`

```ruby
#none?()
```

Indicates that outbound connectivity must be disabled.