Sandbox & Approval Modes, Fully Specified
Current approval presets
| Auto (default) | no flags, or --sandbox workspace-write --ask-for-approval on-request — Read, edit and run inside the workspace; asks before editing outside it or using the network. |
|---|---|
| Safe read-only browsing | --sandbox read-only --ask-for-approval on-request — Reads files and runs commands inside the read-only sandbox; actions outside it can require approval. |
| Read-only non-interactive (CI) | --sandbox read-only --ask-for-approval never — Reads only and never prompts — the shape a CI job actually needs. |
| Auto-review | --sandbox workspace-write --ask-for-approval on-request -c approvals_reviewer=auto_review — Same boundary as Auto, but eligible approval requests go to a reviewer agent instead of you. Uses extra model calls. |
| Dangerous full access | --dangerously-bypass-approvals-and-sandbox (alias --yolo) — No sandbox and no approvals. OpenAI labels it elevated risk and does not recommend it. |
Retired settings that can stop Codex from starting
| Retired: approval_policy = "untrusted" | No longer supported by Codex or ChatGPT Work, and can prevent either client from starting. Replace with: For read-only use: sandbox_mode = "read-only" with approval_policy = "on-request". To keep the stricter command-approval rule: omit approval_policy and add [projects."/path/to/project"] trust_level = "untrusted" to ~/.codex/config.toml. |
|---|
Sandbox mechanics that hold regardless of preset
| Network under workspace-write | Off by default |
|---|---|
| Network proxy feature | Constrains enabled network access; never grants it |
| Protected paths (recursive) | .git, .agents, .codex |
| gitdir: pointer files | Also protected (resolved path) |
| Version-controlled folders | Start in Auto |
| Non-version-controlled folders | Start read-only until trusted |
| Destructive MCP tool calls | Always need approval, regardless of mode |
| Web search modes | cached, live, indexed, disabled — cached is the default |
| Web search under full access | Defaults to live |
| Auto-review | Reviews eligible approvals with extra model calls — adds to usage |
Sandbox and approval are two separate settings that get talked about as one, and the confusion isn't accidental — most people only ever touch the combined presets, never the two dials individually.
Sandbox controls what Codex can touch
Read-only permits reading and answering. Workspace-write permits reading, editing and running inside the current project, with network access off unless enabled in configuration. Danger-full-access removes the boundary entirely — the one mode where the sandbox stops being the safety mechanism.
Approval controls when Codex has to ask
On-request prompts before acting outside the sandbox's boundary. Never removes prompting — except for destructive tool calls, which still stop. A granular policy keeps chosen prompt categories interactive and rejects the rest.
The retired value that breaks startup
approval_policy = "untrusted" used to sit alongside these. Codex and ChatGPT Work no longer support it, and OpenAI warns the setting can prevent either client from starting at all. The stricter "ask before anything not known-safe" behavior now lives in a per-project entry: trust_level = "untrusted" under [projects."/path"] in your user-level config.toml, with no explicit approval policy. Search profiles, startup scripts and managed defaults for the old value.
The presets
Named combinations cover the common cases: Auto, the default; safe read-only browsing; read-only non-interactive for CI; Auto-review, which routes eligible approvals to a reviewer agent; and dangerous full access, aliased --yolo. Auto-review spends extra model calls, so it adds to usage.
What neither setting overrides
.git, .agents and .codex stay read-only recursively under workspace-write, including a .git pointer file's resolved target. Destructive MCP tool calls always need approval. And a folder without version control starts read-only until you trust it. The workspace that workspace-write opens up is the current directory plus temporary directories such as /tmp, and /status shows the exact list for a session.
The tables above list every current preset, the retired setting, and the mechanics that hold regardless.
Verified 2026-10-28 against https://learn.chatgpt.com/docs/agent-approvals-security.
Checked: https://learn.chatgpt.com/docs/agent-approvals-security · https://learn.chatgpt.com/docs/config-file/config-reference