Sandbox access

Sandbox keys start with deterministic prefixes (rk_test_* in developer environments).
Sandbox metering never bills production SKU lines — separate tenant namespace.
CAD exports are blocked from production egress while on sandbox entitlement.