Separate capability from approval
sandbox_mode constrains command access. approval_policy controls when approval can be requested. Removing prompts does not grant unrestricted access, and workspace write permission does not make every path or network destination available.
Inspect without editing
codex --sandbox read-only --ask-for-approval on-requestAsk Codex to read the README, describe the repository, and identify one area to investigate. Do not create test files merely to prove that the session is read-only. Review any requested access against the actual task.
Edit within a workspace
sandbox_mode = "workspace-write"
approval_policy = "on-request"This permits routine work inside authorized roots while allowing requests for additional access. Some environments still protect .git, .codex, .agents, and .aws paths. Editing source does not imply permission to write those directories. Keep commit and deployment expectations explicit.
Command networking is not web search
A successful web search does not prove that npm or a Python subprocess has network access. The workspace-write command sandbox normally starts with networking disabled. Configure network access only when the task needs it, subject to managed requirements.
| Problem | Relevant checks |
|---|---|
| Dependency installation | Command networking, proxy, registry, and certificates |
| Web lookup | web_search configuration and tool availability |
| MCP connection | Endpoint, authentication, and execution environment |
| Writes outside the project | Authorized roots and sandbox boundaries |
Migrate retired untrusted values
For interactive read-only work, use read-only plus on-request. Project trust_level can produce a different, stricter approval policy and also changes whether project configuration loads. These mechanisms are not interchangeable; identify your intended behavior before migrating.
Inspect effective settings
- Record the old values, including existing named permission profiles or managed requirements.
- Start a new session and check /status; use /debug-config for layer diagnostics when available.
- Run one small task-relevant check, without testing against sensitive files.
- If behavior differs, inspect CLI flags, profiles, project layers, and administrative constraints instead of turning off sandboxing.
Named permission profiles provide another supported configuration model. Do not stack a complete permission-profile template with legacy sandbox settings without checking their interaction. Use configuration profiles for scenario differences and AGENTS.md for working agreements.
Sources and version notes
Based on the official documentation below. Replace example URLs, models, and paths for your environment. Older versions and managed environments may differ.
Sources checked：