name: sbx policy set-default
synopsis: Set the default network policy
description: |-
    Set the default network policy for all sandboxes.

    This must be run before adding custom allow/deny rules or starting a sandbox
    for the first time. The default policy determines the baseline network access.

    Available policies:
      allow-all   All outbound network traffic is allowed
      balanced    Typical development traffic is allowed (AI services, package registries, etc.)
      deny-all    All outbound network traffic is blocked

    After setting defaults, use "sbx policy allow/deny" to add custom rules.
    Use "sbx policy reset" to clear all policies and start over.
usage: sbx policy set-default <allow-all|balanced|deny-all> [flags]
options:
    - name: help
      shorthand: h
      default_value: "false"
      usage: help for set-default
inherited_options:
    - name: debug
      shorthand: D
      default_value: "false"
      usage: Enable debug logging
example: |4-
      # Set balanced defaults (recommended)
      sbx policy set-default balanced

      # Allow all traffic
      sbx policy set-default allow-all

      # Block everything, then allow specific sites
      sbx policy set-default deny-all
      sbx policy allow network api.example.com:443
see_also:
    - sbx policy - Manage sandbox policies
