Enterprise policy to allow yolo in CLI sandbox

Describe the feature or problem you'd like to solve

There should be a separate policy scope for cli sandboxes for yolo mode and other permission related enterprise policies

Proposed solution

Enterprise policies allow restrictive access for setting like yolo mode, and other folder/tool settings. These are generally used because of trust within an enterprise environment, where broad tool access could cause damage. The point of sandbox mode is to create a 'safe place' for developers to work agentically. Currently, when yolo mode is disabled by enterprise policy, it applies to both standard and sandbox mode. Ideally, enterprise policies should have a separate sandbox hierarchy where any policy which could make sense to configure more permissively would allow a separate setting.

Example prompts or workflows

No response

Additional context

No response

未指定任何文件、测试或入口点。首先跟踪现有的 enterprise policy 对 yolo mode 和 CLI sandbox 的处理方式，然后确定哪些与权限相关的设置需要单独的 sandbox 作用域。完成的标准是 sandbox 模式可以使用自己的 policy 层级，同时不改变 standard 模式的限制。