OptionallimitsResource limits
Optionalnetworknetwork.fetch:<host> grants the running graph holds. Consulted by
bim.network.fetch on every call (not just once at sandbox creation)
so the allow-list is always the real, current grant set — the
network permission flag above only gates whether the namespace
exists at all. transport replaces fetch for those requests (a host's
own transport, or a test's); it changes how bytes move, never whether a
request is allowed.
OptionalpermissionsPermission configuration
Configuration for creating a sandbox