---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Enable AI
ft:clusterId :
- platai
bundleId :
- platai
workflow :
- Platform
---
# Create a network rule
# Create a network rule for an Arc policy {#ariaid-title1}
Release version: Australia
Updated October 22, 2026
 2 minutes to read
Open a destination that ServiceNow Arc needs to reach, or block one it shouldn't, by adding a network rule for the users a policy covers.
## Before you begin
Role required: sn_ai_governance.ai_steward and sn_app_arc.admin
## About this task
The agent's sandbox can reach only the hosts and ports on its network allowlist. The default Arc policy includes a list of trusted domains, and your policy's rules are merged with that list for the users the
policy covers.
## Procedure
1. Navigate to AllAI Control TowerHomeGovernPoliciesArc policies.
2. Select the policy you want to update.
3. Select the Network rules tab.
4. Select Create network rules.
If the policy already has network rules, select + Add rule instead.
5. On the form, fill in the fields.
{#gov-pol-arc-create-network-rule__table_network_rule_fields__entry__2}
| Field | Description |
|-|-|
| Rule Name | Name that describes what the rule does, for example, Allow GitHub API. |
| Host / Domain | Destination the rule applies to. Enter a host name such as registry.example.com, a wildcard such as *.github.com to cover every subdomain, or an IP range in CIDR notation such as 10.0.0.0/8. |
| Protocol | Protocol the rule applies to. The default is HTTPS. * HTTPS * HTTP * gRPC * SMTP * TCP * Any |
| Access | Whether the sandbox can reach the destination. Allow : Adds the destination to the allowlist. This is the default. Deny : Blocks the destination. Use it to close one host inside a domain that another rule allows, for example, to block a single subdomain while *.example.com stays open. |
| Allow Encoded Slash (%2F) | Option to keep encoded slashes (%2F) in URL paths instead of rejecting the request. Cleared by default. Select it for services that need encoded slashes, such as GitLab project paths that include a namespace. |
| Active | Option to enforce the rule. Selected by default. An inactive rule is left out of the policy for every policy that links it. |
| Enforcement | How strictly Arc applies the rule. Enforce : Applies the rule. This is the default. Audit --- allow and log violation : Lets the traffic through and logs it as a violation. Use it to see what a rule would affect before you enforce it. Disabled : Keeps the rule but doesn't apply it. |
| Port | Port the rule applies to, for example, 443, 80, 22, or 25. Leave it empty to apply the rule to any port. |
| Justification | Business or compliance reason for the rule, kept for your audit trail. |
[Table 1. New Network rules side panel]
{#gov-pol-arc-create-network-rule__table_network_rule_fields}
6. Select Create.
## Result
The rule appears on the policy's Network rules tab, and the sandbox applies it for the users the policy covers at their next policy sync.
## Example: Let developers reach an internal package registry {#gov-pol-arc-create-network-rule__example-allow-registry}
Your developers need Arc to install packages from registry.example.com, which isn't on the default allowlist. On a policy whose user criteria cover the developer group, create a network rule with the following values:
* Rule Name: Allow internal package registry
* Host / Domain: registry.example.com
* Protocol: HTTPS
* Access: Allow
* Port: 443
* Justification: Developers install approved packages from the internal registry.
Leave the other fields at their defaults. At their next policy sync, developers can reach the registry. Everyone else keeps the default allowlist, so the registry stays unreachable for them.
## What to do next
Confirm the rule works as intended on a test user's device before you widen the policy.
*[\>]: and then