Phalcon Volt Sandbox Mode: Which Constructs Are Blocked and How Are Custom Functions Whitelisted?

I'm evaluating Volt's sandbox mode for rendering templates from semi-trusted sources in a Phalcon 4.x application. The documentation states that $volt->setOptions(['sandbox' => true]) restricts execution to a whitelist of tags and functions, and that disallowed constructs raise a sandbox violation at compile time.

What I cannot pin down is the exact boundary of that whitelist in practice:

1. Is the set of allowed tags and filters fixed, or can it be extended per application?
2. When I register custom Volt functions with $compiler->addFunction(), are they automatically permitted inside sandboxed templates, or must they be explicitly whitelisted somewhere else?
3. Does the sandbox also block PHP embedded via {% raw %} or blocks, and does it cover macros and template inheritance across sandboxed and non-sandboxed templates?

My concern is that a custom helper registered for trusted templates might silently become callable from untrusted ones, or conversely that legitimate helpers will fail at runtime rather than compile time. A clear statement of the enforcement scope, plus a reliable way to verify a given construct is blocked before deployment, would settle the design decision.