Managing Network Policies

A network policy is a named pair of IP lists -- addresses allowed to connect and addresses always refused -- kept per environment and assigned wherever access should be limited by source address. One policy can guard many things, and a policy guards nothing until it is assigned. Concerns when managing network policies:

• What a policy decides -- deny beats allow, and an empty allow list admits everything the deny list doesn't name
• Where it applies -- an MCP server, an account API token, workspace-user sign-in, or end-user sign-in
• Editing safely -- a patch changes only what you name; a full replace empties every list it leaves out
• Deleting -- an assigned policy is refused unless forced, and forcing lifts every restriction it imposed
• Lockout -- a policy on the token or sign-in you are using applies to you

Only the account owner and administrators manage network policies, and the feature must be enabled for the account. Each environment (production, a sandbox) keeps its own library: a policy is visible and assignable only in the environment that created it.

How to Run the Steps

This skill names each step by what it reads or changes; the exact calls depend on how you reach the account. Read the one reference that matches your tools -- both follow the step numbers of How to Manage Network Policies below: