name: sbx policy deny
synopsis: Add a deny rule for sandboxes
description: |-
    Add a rule that blocks sandboxes from accessing specified resources.

    Deny rules always take precedence over allow rules. If a resource matches
    both an allow and a deny rule, the request is blocked.
usage: sbx policy deny COMMAND
options:
    - name: help
      shorthand: h
      default_value: "false"
      usage: help for deny
inherited_options:
    - name: debug
      shorthand: D
      default_value: "false"
      usage: Enable debug logging
see_also:
    - sbx policy - Manage sandbox policies
    - sbx policy deny network - Deny network access to specified hosts
