Skip to Content
How-to guidesApprove a blocked domain

Approve a blocked domain

Let your agent reach a new domain in one click, without restarting the space. Your agent needs pypi.org to install a library, or a vendor API to run an integration test: you see the blocked call, approve it, and the agent’s next try works. A space blocks outbound connections by default. When the agent tries a domain that no rule allows, Marshal blocks the call, records it, and shows you a card to approve.

Before you start

  • Role: you own the space, or the run names you as a person it asks.
  • The space is ready or running.
  • Your administrator decides whether Approve & remember for next run is offered for a stack. Approve always works for the current space.

Steps

  1. Open the space (Spaces, then the space). For a run, open the run page instead.
  2. Open the Blocked tab in the right panel. The tab appears only after something was blocked, and it shows a red count of items that still need attention. If the panel is hidden, use the panel toggle in the toolbar.
  3. Find the card for the domain. It shows the host, the protocol, and how many times it was blocked.
  4. Choose how to approve:
    • Click Approve to allow the domain for any protocol, in this space only. A new space from the same manifest blocks it again.
    • Click the arrow next to Approve (More approve options) for more choices:
      • Approve any protocol: the same as the main button.
      • Approve only a protocol and port: the narrowest choice. Other protocols to the same host stay blocked.
      • Approve & remember for next run: does the same as Approve and also saves the rule to your manifest. Future spaces from that manifest start with the domain allowed.
  5. To ignore a card, click Dismiss.

Each approval adds an allow rule, applies it to the running space at once, and is written to the audit log with your name. Tool, MCP, and database calls that were blocked use the same cards, with an Approve button.

What you should see

  • The card changes to “Approved” with a check mark. The banner reads “All N blocked items resolved. History stays here for audit.”
  • The agent’s next attempt to reach the domain works. The space does not restart.
  • After Approve & remember for next run, the rule shows in the manifest editor under Network policy, in Your network additions.
  • In the audit log, Approve adds a space.policy_approved event. Approve & remember for next run adds that event and a manifest.network_allow_add event.

Next

Read the audit log: see every call your agents made, and which ones were blocked.

Run a mission on a schedule or eventArchive and restore a space