The problem is straightforward: when building coding agents or AI apps in Vercel Sandbox, I usually think in terms of services like `OpenAI`, `Claude`, `GitHub`, or `AI Gateway`. But the raw `networkPolicy` API is domain-oriented, so credentials brokering rules get repetitive and harder to read than the actual intent.
I wanted to write:
```ts networkPolicy: allow({ codex: { apiKey: process.env.OPENAI_API_KEY! }, openai: { apiKey: process.env.OPENAI_API_KEY! }, gemini: { apiKey: process.env.GEMINI_API_KEY! }, claude: { apiKey: process.env.ANTHROPIC_API_KEY! }, github: { apiKey: process.env.GITHUB_TOKEN! }, aiGateway: { apiKey: process.env.AI_GATEWAY_TOKEN! }, }) ```
instead of hand-maintaining raw domains and header transforms.
The library expands service names into the domain-level `NetworkPolicy` shape required by Vercel Sandbox. Right now it supports `codex`, `openai`, `gemini`, `claude`, `github`, and `aiGateway`.