Hosted Codex networking requires two independent controls and pinned-client validation
Hosted coding agents need two separately validated network paths: model-mediated web search and sandboxed-command egress. Enabling one does not imply the other. For least-privilege deployments, activate the managed command-network proxy, enable workspace-sandbox networking, restr…