Requires network:read. Returns the saved host list. Workspace hosts add allowed destinations to the platform baseline; an empty list does not remove baseline access. Changes apply at the next Hands start, not as immediate revocation of active leases.

_{Scope: network:read}