syntaqxA host a cloud job's guardrails refuse is named in the refusal's status line, not only its body: `403 Forbidden by g1t guardrails: api.expo.dev is not an allowed domain`. Many tools show only the status line of a failed request. eas-cli's GraphQL client prints the reason phrase and drops a body that is not JSON, and apk prints `HTTP 403: Forbidden`, so a refused Expo call surfaced as a bare "Forbidden" followed by "GraphQL request failed", with nothing pointing at the guardrails. The refusal also carries an x-g1t-blocked-host header beside x-g1t-guardrails: blocked. Its plain-text body says where to allow the host: Allowed domains for every sandbox, or Workflow-only domains for the jobs of one workflow and environment. The guardrails and Actions guides say what a refused request shows.3039e06History
- ..
- agents
- chat
- customize
- folios
- people
- team
- actions-settings.tsx
- agents.tsx
- apps.tsx
- audit-export.ts
- audit.tsx
- billing.tsx
- chat-settings.tsx
- code-access.tsx
- code-overview.tsx
- context.tsx
- emoji.tsx
- gateway.tsx
- guardrails.tsx
- home-seen.ts
- home.tsx
- integrations-directory.tsx
- integrations.tsx
- layout.tsx
- member-invitations.tsx
- members.tsx
- memory.tsx
- moved.ts
- new.tsx
- org-chart.tsx
- overview.tsx
- package.tsx
- packages.tsx
- people.tsx
- permissions.tsx
- personal-access-tokens.tsx
- pins.ts
- projects.tsx
- repositories.tsx
- rules.tsx
- ruleset.tsx
- runners.tsx
- secrets.tsx
- security-bypass.tsx
- security-patterns.tsx
- security-settings.tsx
- security.tsx
- settings.tsx
- soon.tsx
- spend-pill.ts
- spend-receipt.tsx
- spend.tsx
- statement-csv.ts
- statement-entries.ts
- tab-soon.tsx
- team-new.tsx
- teams.tsx
- token-new.tsx
- token.tsx
- tokens.tsx
- usage.tsx
- webhooks.tsx
- workspace-overview.tsx