Approvals and sandbox

Codex uses two controls that work together:

• The sandbox defines which files and network resources generated commands can access.
• The approval policy decides when Codex must stop and ask before crossing a boundary.

Official reference: Agent approvals and security and Sandbox.

Recommended local baseline

codex --sandbox workspace-write --ask-for-approval on-request

This lets Codex read, edit, and run commands inside the current workspace. Network access is off by default, and actions outside the boundary require the applicable approval.

Use read-only mode for investigation:

codex --sandbox read-only

Inside an interactive session, /permissions changes the active policy.

Persistent configuration

In ~/.codex/config.toml:

sandbox_mode = "workspace-write"
approval_policy = "on-request"
approvals_reviewer = "user"

[sandbox_workspace_write]
network_access = false

Grant another writable directory explicitly with --add-dir or the matching configuration key instead of switching the whole process to full access.

Cloud has a different boundary

Codex cloud runs in isolated OpenAI-managed containers:

1. Setup phase: can use the configured network and secrets to install dependencies.
2. Agent phase: network is off by default; setup secrets are removed before the agent begins.

Enabling internet access during the agent phase changes the threat model. Allow only required domains and assume fetched content can contain prompt injection.

Automatic approval review

Codex can use automatic approval review where available:

approvals_reviewer = "auto_review"

That adds model calls and is still a policy decision, not an OS sandbox. Use manual approval for consequential external actions and organization-specific boundaries.

Workshop checklist

• Keep writes scoped to the exercise repository.
• Leave network disabled until a task proves it needs a specific host.
• Review approval prompts for the exact command and scope.
• Use a worktree or disposable cloud environment for high-autonomy tasks.
• Keep API keys and production credentials out of prompts and repositories.