Sandbox & Approval Modes, Fully Specified
Approval presets
| Auto (default) | no flags, or --sandbox workspace-write --ask-for-approval on-request — Read, edit and run inside the workspace; asks before editing outside it or using the network. |
|---|---|
| Safe read-only browsing | --sandbox read-only --ask-for-approval on-request — Reads and answers only. |
| Read-only non-interactive (CI) | --sandbox read-only --ask-for-approval never — Reads only, never prompts — the shape a CI job actually needs. |
| Edit freely, gate untrusted commands | --sandbox workspace-write --ask-for-approval untrusted — Only commands Codex already knows are safe run automatically. |
| Auto-review | …-c approvals_reviewer=auto_review — Same approval boundary as Auto, but eligible approvals are reviewed automatically. |
Sandbox mechanics that hold regardless of preset
| Network under workspace-write | Off by default |
|---|---|
| Protected paths (recursive) | .git, .agents, .codex |
| gitdir: pointer files | Also protected (resolved path) |
| Version-controlled folders | Start in Auto |
| Non-version-controlled folders | Start read-only until trusted |
| Destructive MCP tool calls | Always need approval, regardless of mode |
| Web search default | Cached, OpenAI-maintained index |
| Web search under full access | Defaults to live |
Sandbox and approval are two separate settings that get talked about as one thing constantly, and the confusion isn't accidental — most people only ever touch the combined presets, never the two dials individually.
Sandbox controls what Codex can touch
Read-only permits reading and answering, nothing else. Workspace-write permits reading, editing and running inside the current project, with network access off unless separately enabled. Danger-full-access removes the workspace boundary entirely — the one mode where the sandbox itself stops being the safety mechanism.
Approval controls when Codex has to ask
On-request prompts before anything outside the sandbox's own boundary. Untrusted narrows automatic execution to commands Codex already recognizes as safe, prompting for everything else. Never removes prompting altogether — except for the destructive-tool-call override, which applies regardless of approval mode.
Why the presets exist
Combining the two dials by hand every session is more friction than most workflows need, so a small set of named presets cover the common cases: the default auto posture, a safe read-only browsing mode, a non-interactive read-only mode built for CI, and an "edit freely, gate only untrusted commands" middle ground. Each preset is just a specific sandbox-and-approval pairing with a name, not a third independent mechanism.
What neither setting overrides
Certain paths — .git, .agents, .codex — stay protected recursively regardless of sandbox mode, including when .git resolves through a pointer file rather than sitting there directly. And destructive-annotated MCP tool calls always require approval, even under "never" — the one place approval mode has a hard ceiling neither dial can lift.
Trust posture, the default most people never touch
A version-controlled folder starts in the normal Auto posture. A folder without version control starts read-only until explicitly trusted — a sensible default that trips up exactly the people least prepared for it, usually on a brand-new scratch project.
The table below lists every published mode and preset, with exactly what each one restricts.
Verified 2026-08-09 against https://learn.chatgpt.com/codex/agent-approvals-security.
Checked: https://learn.chatgpt.com/codex/agent-approvals-security · https://learn.chatgpt.com/codex/config-file/config-reference