Claude Managed Agents sandboxes enforce network egress controls using domain allowlists or total network access termination