approval_policy untrusted Stops Codex Starting

The mistake

Keeping approval_policy = "untrusted" in a config file — or copying it from an older README, a team template or a startup script — and expecting Codex to keep asking before running any command it doesn't already know is safe.

Why this happens

untrusted used to be one of the documented approval modes, and for cautious setups it was the obvious choice: run only commands known to be safe, ask about everything else. Codex and ChatGPT Work no longer support it as an approval_policy value. Because the setting sat quietly in config files that nobody revisits, the first sign of the change is often not a warning but a client that won't start. OpenAI says the retired value can prevent Codex or ChatGPT Work from starting at all.

Why it matters

A config that stops Codex launching blocks everyone who shares it, and the value tends to live in more than one place: a user config, a project config, a profile, a startup script, a team's managed defaults. Fixing one copy and missing another produces the confusing result of Codex working for one person and failing for the next. And deleting the line without replacing it quietly loosens a setup someone chose to be strict.

The fix

Remove approval_policy = "untrusted" from user and project configuration, profile files, startup scripts and managed defaults. Then choose what you actually want:

Read-only, interactive: set sandbox_mode = "read-only" with approval_policy = "on-request", or launch with --sandbox read-only --ask-for-approval on-request. Commands the sandbox allows then run without asking.
The old strict behavior: leave approval_policy unset and add a project entry to your user-level ~/.codex/config.toml — trust_level = "untrusted" under [projects."/path/to/project"]. Commands then need approval unless an execution-policy rule allows them.

Know the side effects of the second route. It also disables that project's local configuration, explicitly setting on-request overrides it, and in managed environments the allowed approval policies must include untrusted for it to apply.

Checking that it's gone

After editing, start Codex in the affected project and run /status to confirm the approval policy it actually loaded. /debug-config shows every configuration layer and any managed requirements — the quickest way to find a stray untrusted in a profile or managed default you didn't know existed.