diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Revision history for pms-application-service
 
+## 0.1.2.0 -- 2026-05-31
+
+* Added pms-infra-agent-socket, pms-infra-agent-serial.
+
 ## 0.1.1.0 -- 2026-05-02
 
 * Add agentAllowedCmds config to restrict agent-proc-run commands.
@@ -19,7 +23,6 @@
 ## 0.0.7.0 -- 2025-07-27
 
 * Fixed resources templates.
-
 
 ## 0.0.6.0 -- 2025-07-20
 
diff --git a/pms-application-service.cabal b/pms-application-service.cabal
--- a/pms-application-service.cabal
+++ b/pms-application-service.cabal
@@ -20,7 +20,7 @@
 -- PVP summary:     +-+------- breaking API changes
 --                  | | +----- non-breaking API additions
 --                  | | | +--- code changes with no API change
-version:            0.1.1.0
+version:            0.1.2.0
 
 -- A short (one-line) description of the package.
 synopsis:           pms-application-service
diff --git a/src/PMS/Application/Service/App/Control.hs b/src/PMS/Application/Service/App/Control.hs
--- a/src/PMS/Application/Service/App/Control.hs
+++ b/src/PMS/Application/Service/App/Control.hs
@@ -66,6 +66,8 @@
               , DM._invalidCharsDomainData = conf^.invalidCharsConfigData
               , DM._invalidCmdsDomainData  = conf^.invalidCmdsConfigData
               , DM._allowedAgentCmdsDomainData = conf^.agentAllowedCmdsConfigData
+              , DM._sandboxNetworksDomainData  = conf^.sandboxNetworksConfigData
+              , DM._invalidPatternsDomainData  = conf^.invalidPatternsConfigData
               , DM._timeoutMicrosecDomainData = conf^.timeoutMicrosecConfigData
               }
 
diff --git a/src/PMS/Application/Service/DM/Type.hs b/src/PMS/Application/Service/DM/Type.hs
--- a/src/PMS/Application/Service/DM/Type.hs
+++ b/src/PMS/Application/Service/DM/Type.hs
@@ -50,6 +50,8 @@
   , _invalidCharsConfigData :: [String]
   , _invalidCmdsConfigData :: [String]
   , _agentAllowedCmdsConfigData :: [String]
+  , _sandboxNetworksConfigData  :: [String]   -- ^ CIDR list for agent-socket-open
+  , _invalidPatternsConfigData  :: [String]   -- ^ regex blacklist for write commands
   , _timeoutMicrosecConfigData :: Int
   } deriving (Show, Read, Eq)
 
@@ -95,6 +97,8 @@
         , "reboot", "kill", "nc", "sudo", "su"
         ]
       , _agentAllowedCmdsConfigData = def   -- deny all by default
+      , _sandboxNetworksConfigData  = def   -- deny all by default
+      , _invalidPatternsConfigData  = def   -- allow all by default
       , _timeoutMicrosecConfigData = 30 * 1000 * 1000
       }