ai-gov: update deny rule behavior and add new flag

[craig-osterhout]

Description

Update governance docs for local deny rules.

• Clarified that local deny rules are evaluated under org governance and layer on top of org policy. Only allow rules are inactive.
• Added examples of the --deny-network flag (new in v0.38) on sbx create and sbx run, which sets per-sandbox deny rules at creation time.

https://deploy-preview-25714--docsdocker.netlify.app/ai/sandboxes/governance/

Related issues or tickets

https://docker.slack.com/archives/C097C5LRXFF/p1785455753455409

Reviews

• Technical review
• Editorial review
• Product review

[netlify]

✅ Deploy Preview for docsdocker ready!

Name	Link
🔨 Latest commit	aa24bbf
🔍 Latest deploy log	https://app.netlify.com/projects/docsdocker/deploys/6a721652bc00e50008eadd64
😎 Deploy Preview	https://deploy-preview-25714--docsdocker.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[docker-agent]

Assessment: 🟢 APPROVE

The changes clearly and consistently clarify the distinction between local allow rules (inactive under org governance) and local deny rules (still evaluated and layering on top of org policy). The new --deny-network flag examples are accurate and well-integrated. No style violations, no vendored files, no missing redirects.

[docker-agent]

Assessment: 🟢 APPROVE

The changes correctly and consistently update the governance documentation across all three files to reflect that local deny rules remain active under org governance while local allow rules do not. The new --deny-network flag examples for sbx create and sbx run are accurate and well-placed. No style violations, broken commands, or missing redirects detected.

[docker-agent]

Assessment: 🟢 APPROVE

No significant issues found. The changes correctly document that local deny rules remain active under org governance while local allow rules are inactive, and add clear examples of the new --deny-network flag for sbx create and sbx run. Content is accurate, well-structured, and follows Docker documentation style guidelines.

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION

[docker-agent]

Assessment: 🟢 APPROVE

This PR cleanly updates the AI sandbox governance documentation to reflect the new deny-rule behavior and adds the --deny-network flag documentation. No issues found.

What was reviewed:

• concepts.md — updated description of local deny vs. allow rule behavior under org governance
• local.md — added --deny-network flag usage for sbx create and sbx run
• org.md — clarified that only allow rules are inactive under org governance

All added content is factually precise, uses correct inline code formatting for flags and commands, follows Docker style guide conventions (no AI-isms, no bold misuse, no heading violations), and requires no redirects (no pages removed or renamed).