Codex Sandbox and Approvals skill for Codex

The right setting is the narrowest boundary that lets the task finish without a human babysitting it. Two independent controls decide this: the sandbox (what commands can technically touch) and the approval policy (when Codex must stop and ask before crossing the sandbox). Pick both deliberately, then prove the boundary with a test command.

Decision table

Task	Sandbox	Approvals	Flags
Explore, explain, plan; no edits	read-only	on-request	codex -s read-only -a on-request
Normal local coding in a git repo (Auto preset)	workspace-write	on-request	default, or -s workspace-write -a on-request
Same, but fewer interruptions with a safety net	workspace-write	on-request + approvals_reviewer = "auto_review"	-c approvals_reviewer=auto_review
Needs package installs or API calls	workspace-write + network on, ideally domain-limited	on-request	-c sandbox_workspace_write.network_access=true
CI analysis, reports, reviews	read-only	never asks (exec default)	codex exec (read-only by default)
CI that edits the checkout	workspace-write	never asks	codex exec -s workspace-write
Inside a disposable container or VM that is the real boundary	danger-full-access	never	--dangerously-bypass-approvals-and-sandbox (alias --yolo) only there

Default to the Auto preset for interactive work. Escalate one notch at a time, and prefer granting a specific directory or domain over switching to full access.

How each control behaves

Sandbox modes (enforced by the OS: Seatbelt on macOS, bwrap plus seccomp on Linux and WSL2, MXC or legacy elevated/unelevated sandbox on native Windows):

• read-only: commands can read; no writes, no network.
• workspace-write: writes inside the workspace (cwd plus temp dirs, see /status) and any --add-dir / writable_roots; network off unless enabled. .git, .agents, .codex and .aws under writable roots stay read-only, recursively, so git commit normally needs approval.
• danger-full-access: no sandbox. Web search also defaults to live results here.

Approval policies:

• on-request: commands inside the sandbox run freely; Codex asks before leaving it (writing outside, network when off, other escalations).
• never: never asks; anything the sandbox blocks fails and the error goes back to the model. Pair with the narrowest sandbox that still works.
• { granular = { sandbox_approval = true, rules = true, mcp_elicitations = true, request_permissions = false, skill_approval = false } }: keep some prompt categories interactive, auto-reject the others.
• untrusted is retired and can stop Codex from starting. For “ask before everything not explicitly allowed”, omit approval_policy and mark the project [projects."/path"] trust_level = "untrusted"; execpolicy rules then decide (rules match command argument prefixes only, so allow git status, not a pattern inside args).

Automatic approval review (approvals_reviewer = "auto_review") routes requests that already need approval through a reviewer agent instead of you. It does not widen the sandbox, fails closed on errors and timeouts, and costs extra model calls. In the TUI, /approve retries one recent denial. In codex exec, --approve-for-me uses workspace-write plus automatic review.

Workflow

- [ ] 1. Identify what the task must write and which hosts it must reach
- [ ] 2. Pick sandbox + approval from the table
- [ ] 3. Grant the minimum extras (dirs, network, domains)
- [ ] 4. Test the boundary with codex sandbox before relying on it
- [ ] 5. Record the choice (profile file or AGENTS.md note)

3. Grant the minimum extras

Extra writable directory for one run (beats switching to full access):

codex --add-dir ../shared-lib

Network for commands, limited to specific domains (the proxy enforces the list only when network is on AND the proxy feature is on):

[sandbox_workspace_write]
network_access = true

[features.network_proxy]
enabled = true
domains = { "registry.npmjs.org" = "allow", "pypi.org" = "allow", "files.pythonhosted.org" = "allow" }

Domain patterns: exact host; *.example.com subdomains only; **.example.com apex plus subdomains; * allow-all. deny beats allow. Local and private addresses stay blocked unless you allow an exact localhost or IP literal (or set allow_local_binding = true).

Per-repo strictness without global changes:

[projects."/Users/me/src/vendor-fork"]
trust_level = "untrusted"

Permission profiles (beta)

Named profiles combine filesystem and network rules: built-ins :read-only, :workspace, :danger-full-access, or custom [permissions.<name>] selected by default_permissions. They do not compose with sandbox_mode: if sandbox_mode appears in any loaded layer or --sandbox is passed, the older settings win and the profile is ignored. Use one model per machine.

default_permissions = "project-edit"

[features]
network_proxy = true

[permissions.project-edit]
extends = ":workspace"                  # keeps .git/.agents/.codex/.aws read-only

[permissions.project-edit.filesystem.":workspace_roots"]
"**/*.env" = "deny"

[permissions.project-edit.network]
enabled = true

[permissions.project-edit.network.domains]
"api.github.com" = "allow"

4. Test the boundary

codex sandbox runs any command under the same policy Codex uses:

codex sandbox macos --log-denials -- touch ../outside.txt        # expect a denial
codex sandbox linux -- curl -sI https://example.com              # expect failure with network off
codex sandbox macos --permissions-profile project-edit -- cat .env   # expect denied

Then in the TUI run /status to confirm sandbox, approval policy and writable roots, and /permissions to switch modes mid-session.

Gotchas

• The command network proxy filters only commands Codex spawns. Web search, MCP servers, apps/connectors and model traffic are separate; restrict them with web_search, mcp_servers.<id>.enabled_tools / approval modes, and feature flags.
• features.network_proxy without network_access = true does nothing; network stays off. network_access = true without the proxy means unrestricted outbound traffic.
• Destructive MCP or app tools that advertise a destructive annotation always prompt, unless the tool also claims to be read-only. Do not trust third-party annotations blindly.
• Inside Docker, bwrap may lack the namespaces it needs. Either grant the capabilities or make the container the boundary and run danger-full-access inside it, only for trusted repositories: anything in the container, including Codex credentials, is reachable.
• shell_environment_policy.ignore_default_excludes defaults to true, so secret-looking variables are passed to commands. Set it to false for untrusted work.
• -a never with read-only is safe for analysis but makes edit tasks fail repeatedly; check the transcript for denials before blaming the model.
• WSL1 is no longer supported by the Linux sandbox; use WSL2.
• A workspace-write session can still edit files that run later with your privileges (git hooks are protected, but Makefile, package.json scripts and CI files are not). Review the diff before running project scripts outside Codex.

Output contract

**Mode:** workspace-write + on-request (auto_review on)
**Extras:** --add-dir ../shared-lib; network on, proxy allowlist: registry.npmjs.org, pypi.org
**Boundary test:** write outside workspace denied; curl example.com blocked; npm install ok
**Saved as:** ~/.codex/deps.config.toml (use: codex --profile deps)