sandbox regulations