# Overview

Configure Sandbox access, Apps, instructions, and models

The Admin Panel has a dedicated **Sandbox** section for the settings that apply across your workspace.

| Setting | Where to find it |
| --- | --- |
| User access | **Admin Panel → Sandbox → Access** |
| Apps and action policies | **Admin Panel → Sandbox → Apps** |
| Workspace-wide instructions | **Admin Panel → Sandbox → Instructions** |
| Models available to Sandbox | **Admin Panel → Language Models** |
| Custom Skill sharing and management | **Sandbox → Skills** |

If you self-host Quor, first configure the runtime described in [Deploying Sandbox](/deployment/local/craft).
The deployment guide covers sandboxes, the proxy, workers, networking, storage, resources, and environment variables.

## Control access

Open **Admin Panel → Sandbox → Access**.

| Control | Effect |
| --- | --- |
| **Enable Sandbox by default** | Turns Sandbox on or off for users who do not have an individual override. |
| **Per-user access** | Creates an exception to the workspace default for that user. |

For a limited rollout, turn off **Enable Sandbox by default**, then enable the users who should have access.
Per-user exceptions remain in place if you later change the workspace default.

<Info>
  Removing access prevents the user from starting new Sandbox work and skips future Scheduled Task runs they own.
  It does not stop a turn already in progress or delete their sessions, files, Skills, Apps, or Scheduled Tasks.
</Info>

## Add workspace instructions

Open **Admin Panel → Sandbox → Instructions** to add guidance that every Sandbox agent in your workspace should follow.
Quor appends these instructions to Sandbox's built-in instructions as an **Organization instructions** section.

Good workspace instructions describe stable expectations that should apply to all Sandbox work:

| Use workspace instructions for | Keep elsewhere |
| --- | --- |
| Brand voice, terminology, and formatting conventions | Instructions for one workflow—put these in a Skill |
| Organization-wide handling rules for generated content | Credentials or secrets—configure these through Apps |
| Standard output requirements, such as citations or disclaimers | Details that change for every request—include these in the prompt |

For example:

```md
For client-facing deliverables:

- Use the company name "Acme" rather than "Acme, Inc."
- Use concise, direct language and avoid unsupported performance claims.
- Add "Confidential" to draft materials unless the user requests otherwise.
```

The editor accepts up to 4,000 characters.
Select **View base instructions** to see the built-in prompt your text is added to,
or **Reset to default** to remove the workspace instructions.

<Warning>
  Workspace instructions supplement Sandbox's built-in behavior. They cannot override its hard rules, App policies,
  user permissions, or other enforced controls.
</Warning>

Changes apply when a Sandbox session starts or is restored. They do not alter a session while it is actively running.
Use **Try in Sandbox** to test the saved instructions in a new session.

## Configure models

Sandbox supports Anthropic, OpenAI, and OpenRouter providers.

Users also need access to the provider and at least one visible model.
Give users provider access publicly or through a group. Agent whitelists apply to Quor Agents, not Sandbox.
See [Language Model Access Controls](/admins/advanced_configs/llm_access_controls) for provider visibility settings.

<CardGroup cols={3}>
  <Card title="Anthropic" icon="brain" href="/admins/ai_models/anthropic">
    Configure an Anthropic provider and choose visible models.
  </Card>

  <Card title="OpenAI" icon="bolt" href="/admins/ai_models/openai">
    Configure an OpenAI provider and choose visible models.
  </Card>

  <Card title="OpenRouter" icon="robot" href="/admins/ai_models/openrouter">
    Configure OpenRouter and select the models available through it.
  </Card>
</CardGroup>

## Configure Apps and Skills

<CardGroup cols={2}>
  <Card title="Apps" icon="plug" href="/admins/managing_features/craft_apps">
    In **Admin Panel → Sandbox → Apps**, configure external services, credentials, and action policies.
  </Card>

  <Card title="Skills" icon="wand-magic-sparkles" href="/admins/managing_features/craft_skills">
    In **Sandbox → Skills**, review reusable instructions and share custom Skills with users or groups.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The Sandbox section does not appear in the Admin Panel">
    Confirm you are signed in as an Admin. The section is hidden when Sandbox is unavailable on the deployment.
    Self-hosted operators should review [Deploying Sandbox](/deployment/local/craft).
  </Accordion>

  <Accordion title="A user has access but cannot start a session">
    Confirm the user can access an Anthropic, OpenAI, or OpenRouter provider with at least one visible model.
    A provider limited only to an Agent whitelist is not available in Sandbox.
  </Accordion>

  <Accordion title="A user still has different access after the default changes">
    Check the user's setting under **Admin Panel → Sandbox → Access**.
    A per-user exception takes precedence over the workspace default until you change it.
  </Accordion>

  <Accordion title="Saved workspace instructions are not affecting a session">
    Start a new session to test the saved instructions. They do not update an actively running session.
    Also confirm the guidance does not conflict with Sandbox's built-in hard rules or an enforced App policy.
  </Accordion>
</AccordionGroup>

<CardGroup cols={2}>
  <Card title="Deployment" icon="server" href="/deployment/local/craft">
    Configure the runtime required for self-hosted Sandbox.
  </Card>

  <Card title="Architecture" icon="diagram-project" href="/security/architecture/craft">
    Review sandbox isolation, credential injection, approvals, and sharing boundaries.
  </Card>
</CardGroup>