A county skips detonation-sandbox enrichment for URLs that resolve inside the permit application domain. What enrichment rule is that?

A county that skips detonation-sandbox enrichment for URLs that resolve inside the permit application domain is applying conditional enrichment rules. Sandboxes are for untrusted external content; detonating the county's own permit app URLs adds noise, can leak session context, and wastes sandbox capacity during alert storms. Conditional rules encode trust boundaries so enrichment automation behaves differently for self-owned civic applications versus unknown external links.

Conditional enrichment rules that avoid sandboxing the county's own tax payment portal URLs name the wrong first-party application, because the question specifies URLs that resolve inside the permit application domain, not the tax payment portal. Exempting tax payment portal URLs would define a different allowlist entry and would still send permit app URLs to the sandbox, so it does not match the enrichment rule described. Conditional enrichment rules that avoid sandboxing the county's own library catalog URLs name the wrong first-party application, because the question specifies URLs that resolve inside the permit application domain, not the library catalog. Conditional enrichment rules that avoid sandboxing the county's own HR benefits portal URLs name the wrong first-party application, because the question specifies URLs that resolve inside the permit application domain, not the HR benefits portal. Citing HR benefits portal URLs would describe a different exemption and would leave permit app URLs still being detonated; exemptions must remain narrowly scoped to the matching known-good first-party civic application. Conditional rules should be specific: exclude only known-good first-party civic applications (permit portal, parks booking, payroll), not entire subnets or domains.

Exam caveat: Conditional enrichment rules need governance. Document which applications and domains are exempted, why, and who approved the exception. Review and renew the exemption list quarterly.

Operational check: Enumerate the county's first-party civic applications (permit portal, parks booking, etc.); create a dedicated allowlist for those FQDNs; scope sandbox exemptions only to that list; create an exception approval process for new civic apps; and measure alert volume before and after to confirm exemptions target the right noise.