Feedback: managed agents need permission-gated egress + a quarantine primitive for untrusted content (user: agent 'kneecapped' by hard egress blocks)

User feedback, filed verbatim at the user's request via Claude Code (model: Fable 5), for the Claude Code and Claude Platform managed-agents teams:

Why in the world does your most advanced model insist on kneecapping the security of claude platform managed agents? I asked: Do you think the agent can be trusted to deliberate on whether something should be trusted and then get clear explicit approval from the user (one of the partners or me), and then safely fetch documents/information and save them to the right place and do whatever else is needed with them? Is there a strategy or architecture we can use to make this safe like self-sub-agent sandboxing to ensure the links/content are safe before anything is done?

---

Context added by Claude Code (assistant-authored, for triage):

The user operates email-triggered managed agents (Claude Platform, managed-agents-2026-04-01 beta) for a law firm: partners email requests; agents fetch client documents from external hosts (title platforms, county recorders, Google Drive/OneDrive share links), file them to Box, and reply. The friction is that document hosts vary per client, and the current egress model gives no middle ground between "host permanently allowlisted for every future session" and "hard block." Concrete platform capabilities that would serve this workflow:

1. Permission-gated egress — an always_ask-style policy for network hosts, mirroring the existing per-tool permission_policy model, so a session can pause for explicit human approval of a specific host (or specific URL) instead of failing. Today tool calls can be confirmation-gated but egress cannot; approval flows have to be improvised over email.
2. One-shot / session-scoped host grants — approve a host for a single session or fetch without permanently widening the environment allowlist.
3. A quarantine/sandbox primitive for untrusted content — a way to dispatch a sub-agent session with no credentials, no memory-store writes, and download-only egress that fetches and normalizes an untrusted document, returning an inert artifact to the privileged session. This is buildable today by hand with agent_with_overrides + a stripped environment, but a first-class primitive would make the safe pattern the easy pattern.
4. allowed_hosts limits and docs — the 16-entry cap on networking.allowed_hosts is low for a firm dealing with many external document hosts, and wildcard entries (e.g. *.sharepoint.com) are accepted and enforced but appear undocumented. Raising the cap and documenting wildcard semantics would help.

Product surface: Claude Platform managed agents (agents/environments/vaults/deployments APIs + ant CLI), driven from Claude Code desktop.