Organization Owners manage external domains in Settings → Organization → Security → Domain allowlist.
In Spaces, an empty list means No organization restriction: pages can load external HTTPS resources and make requests, subject to browser security. Adding domains to an empty list establishes a restriction covering external scripts, images, styles, fonts, media, connections, forms and frames. Migrated permissions lists keep their existing behavior until an Owner explicitly confirms that wider restriction, as described below.
Business and eligible Enterprise contracts can configure restrictions. Existing paid subscriptions retain their management rights. A downgrade keeps an existing restriction working. On an ineligible plan, an Owner can inspect or remove the whole restriction, but cannot edit a nonempty list. Upgrading restores editing; it does not restore a restriction that was removed.
Add destinations
Enter bare domains such as api.example.com, without https:// or a page path.
Add every destination your pages need. You can add up to 50 entries.
Use *.example.com for subdomains at any depth. It does not include
example.com; add that separately when needed. A non-default port, such as
api.example.com:8443, is supported. Each entry covers every path on that host.
Removing one entry tightens a populated restriction. Removing the last entry removes the restriction and permits external HTTPS destinations again. Review that warning before confirming removal.
Changes take time to reach pages. Reload an open page after changing the list. Pages already open can retain their previous settings; this is not an immediate revocation control.
Existing lists migrate automatically
An existing permissions list keeps the same behavior through migration: requests, forms and matching embeds use the listed destinations. Other external HTTPS resources retain their existing permissions. No Owner action is required to migrate.
To tighten that policy to cover all external resource classes, select Review for Spaces, check the exact destinations, and choose Confirm this restriction for Spaces. Before activation, current permissions stay unchanged; afterwards, confirmation applies the full-resource restriction. Ordinary list edits retain the existing behavior until you explicitly confirm the tighter policy.
Confirmation and post-migration list edits require an eligible plan. Existing permissions remain effective on other plans; an Owner can inspect or clear the whole list. Migration never clears the list or confirms a tighter policy for you.
Browser and service limits
Allowing a domain does not provide credentials or bypass CORS. The remote service still controls authentication and embedding. In Spaces, an unrestricted embed keeps an opaque sandbox; explicitly listed trusted embeds can use their own cookies and storage, with the remaining sandbox restrictions intact.
The setting restricts browser resource destinations. It does not prevent top-level navigation or govern requests made inside a permitted third-party embed. Allowed scripts and destinations can receive information from the page. Browser-captured pages and browser editors keep their separate security rules. Do not put secrets in published HTML or domain names.
This is an Owner security decision in the dashboard. There is no CLI or agent setting action; an agent can direct the Owner to the setting.