DownloadCodex Unofficial guide
English

Codex sandbox and approvals

Two settings control what Codex can do on its own. sandbox_mode sets the boundary (read-only, workspace-write, or danger-full-access) and approval_policy sets when it must ask you (on-request or never). A safe default is workspace-write with on-request. Codex then edits inside your project and asks before going further.

The safe default

sandbox_mode = "workspace-write"
approval_policy = "on-request"

With these, Codex can edit files in your project. It asks before running commands that need more access. OpenAI’s docs also note that some paths inside writable roots stay protected, including .git, .agents, .codex, and .aws.

What each sandbox mode means

sandbox_modeCodex can
read-onlyRead files and answer questions, but not change anything
workspace-writeEdit inside the project (writable roots)
danger-full-accessAct anywhere on your machine, without the project boundary

Why full access is risky

OpenAI warns that full access means Codex isn’t limited to your project directory and “might perform unintentional destructive actions that can lead to data loss.” Prefer keeping the sandbox and using rules for targeted exceptions.

Approval prompts

  • on-request: Codex asks when it needs to go beyond the sandbox.
  • never: Codex doesn’t ask. It tries to solve problems within its current permissions.

The older untrusted value is retired. OpenAI has a migration note for configs that still use it.

Windows

The desktop app’s native agent runs commands in PowerShell with a Windows sandbox. Choose Ask for approval below the composer to apply sandbox protections. In WSL mode, it uses Linux sandboxing. In config.toml, OpenAI suggests preferring MXC where supported:

[windows]
sandbox = "elevated"

[features]
prefer_mxc = true

Permission profiles

Codex also ships built-in permission profiles, :read-only, :workspace, and :danger-full-access, and supports custom ones under [permissions.<name>]. In the CLI, /permissions shows the active sandbox and writable roots before you continue.

Questions people ask

What does --yolo do?

OpenAI's config docs describe --yolo as a full access sandbox setting. Among other things, it switches web search to live results. Avoid it on machines or repositories you care about.

My setting is greyed out. Why?

On managed machines, your organization can enforce limits through requirements.toml, for example disallowing approval_policy = "never" or sandbox_mode = "danger-full-access". Local settings can't override those.

Sources

We link to the official source for every instruction on this page. If anything here disagrees with them, trust the official source and tell us.

Read next