Based on OpenAI’s official docs, checked October 21, 2026

Codex sandbox modes and approval policies explained

OpenAI Codex controls what the agent can do with two separate settings. The sandbox mode decides what Codex can technically do when it runs commands, such as where it can write and whether it can reach the network. The approval policy decides when Codex must stop and ask you. This guide explains both, the combinations OpenAI documents, and where the protected paths are, using OpenAI’s Codex docs checked October 21, 2026.

1. 1. Start with the default Auto preset

   With no flags, Codex CLI and the IDE extension use workspace-write with on-request approvals. Codex can read files, edit and run commands in the workspace, and asks before editing outside it or using the network.

   codex --sandbox workspace-write --ask-for-approval on-request

2. 2. Use read-only to chat or plan

   read-only lets Codex read files and run commands inside a read-only sandbox. Switch during a session with the /permissions command.

   codex --sandbox read-only --ask-for-approval on-request

3. 3. Turn on network only if you need it

   In workspace-write, network access is off by default. Enable it in config.toml. To limit which hosts commands can reach, OpenAI documents a network_proxy feature with allow and deny domain rules, where deny always wins.

   [sandbox_workspace_write]
   network_access = true

4. 4. Save presets as profiles

   Put a sandbox and approval pair in a profile file and pick it with codex --profile. OpenAI’s examples include a full_auto profile and a readonly_quiet profile.

   # ~/.codex/readonly_quiet.config.toml
   approval_policy = "never"
   sandbox_mode    = "read-only"

5. 5. Test what the sandbox blocks

   Run a command under the Codex sandbox to see what it can reach: codex sandbox macos, codex sandbox linux or codex sandbox windows, followed by the command. On macOS, --log-denials logs what was blocked.

   codex sandbox linux curl https://example.com

Sandbox modes

read-only: Codex can read files and run commands within a read-only sandbox.

workspace-write (default): Codex can write in the workspace; network is off unless you enable it. Some paths stay read-only even inside the workspace: .git (and the resolved Git directory when .git is a pointer file), .agents, .codex and .aws, recursively.

danger-full-access: no sandbox. Codex can read, edit and run commands with network access. OpenAI says to use caution, and suggests it mainly when a container is your intended security boundary.

Approval policies

on-request: commands allowed by the sandbox run without asking; Codex asks before leaving the sandbox, such as for network access or writes outside the workspace.

never (-a never): Codex never asks and works within the sandbox you set. With read-only it suits CI.

granular: keeps specific prompt categories interactive and rejects others automatically. It covers sandbox approvals, rule prompts, MCP prompts, request_permissions prompts and skill-script approvals.

untrusted is retired. OpenAI now suggests read-only with on-request, or marking a project trust_level = "untrusted" in your user config so commands need approval unless a rule allows them.

Common combinations from OpenAI’s docs

Auto: workspace-write + on-request (the default).

Safe read-only browsing: read-only + on-request.

Read-only CI: read-only + never.

Auto-review: workspace-write + on-request with approvals_reviewer = "auto_review", which routes eligible approval requests to a reviewer agent instead of you. It uses extra model calls, so it can add to Codex usage.

Dangerous full access: --dangerously-bypass-approvals-and-sandbox (alias --yolo). No sandbox and no approvals; OpenAI marks it not recommended.

Rules that skip the prompt

Codex rules (prefix_rule in ~/.codex/rules/*.rules) can allow, prompt or forbid specific commands outside the sandbox. Commands you add to the allow list from the TUI are saved to ~/.codex/rules/default.rules. See our guide to safe permission rules before accepting broad ones.

Tips

• Keep network off by default and turn it on per profile.
• Prefer read-only + never for CI jobs that only need to inspect code.
• Use danger-full-access or --yolo only inside a container or VM you can throw away.
• With --yolo or full access, web search defaults to live results instead of the cache, according to OpenAI.

Next steps

Sources

• https://developers.openai.com/codex/agent-approvals-security · checked 2026-10-21
• https://developers.openai.com/codex/rules · checked 2026-10-21