Combining Sandbox and Approval Flags Correctly

Two independent dials produce a genuinely large number of possible combinations, and not every combination that's technically valid is actually sensible for a given task — understanding which pairings genuinely make sense, and precisely why, is what separates deliberately configuring a session from simply picking flags that happen to compile without error and simply calling that good enough without any further thought.

The pairings this site names as sensible defaults, and why each one works

Workspace-write paired with on-request is the ordinary interactive default, sensible because it assumes a present, available human who can actually answer prompts as they come up. Read-only paired with never is the CI-appropriate profile, sensible because there's nothing destructive possible under read-only in the first place, so removing prompts costs nothing in safety. Workspace-write paired with untrusted sits between these two, sensible for a session you want to run with less interruption than full on-request but aren't ready to hand fully unattended execution to. Each pairing makes sense because the approval posture actually matches what the sandbox mode makes possible and what context the session is running in.

A pairing worth real scrutiny: permissive sandbox with lenient approval, unattended

Workspace-write, or worse, danger-full-access, paired with never-prompt, running genuinely unattended with nobody positioned to notice if something goes wrong, is the combination that deserves the most careful thought before adopting it — you're combining real capability with no human check at all, for a context where nothing is watching closely enough to catch a mistake as it happens. This isn't automatically wrong, but it's the pairing most worth justifying explicitly rather than falling into by default.

Why "more permissive sandbox, therefore stricter approval" is a reasonable heuristic

A useful rule of thumb, worth treating as a default rather than an absolute law: as sandbox permissiveness increases, approval strictness should generally increase to compensate, not decrease. A highly capable, broadly permissive session benefits most from a human actually checking what it's about to do; a narrowly scoped, low-capability session can more safely run with less oversight, since there's structurally less it could do wrong even without a check.

Where this heuristic legitimately breaks down

The read-only-plus-never pairing is the clear, sensible exception to that heuristic — a narrow sandbox with lenient approval isn't risky specifically because the sandbox is narrow enough that lenient approval doesn't cost anything meaningful. The heuristic is a reasonable default, not an inviolable rule; understanding why the CI-appropriate pairing is a legitimate exception is more useful than treating the heuristic as universal and being confused when a genuinely sensible pairing seems to violate it.

Testing an unfamiliar combination before trusting it with real work

For any pairing you haven't used before, running it against a low-stakes, easily-reversible task first — before trusting it with something that actually matters — confirms it behaves the way you expect, the same due diligence this site recommends for any new workflow configuration. A combination that sounds reasonable in the abstract can still behave in an unexpected way in practice, and a cheap test catches that before a costly one would have to.

Combining flags in scripts versus combining them interactively

A script or automation invoking Codex with a specific sandbox-and-approval combination baked in deserves the same scrutiny as an interactive choice, arguably more, since a script's configuration gets reused every single time it runs, unattended, without anyone re-evaluating the choice on each individual invocation. Reviewing a script's baked-in flag combination periodically, not just when it's first written, catches a combination that made sense at the time but hasn't aged well as the script's actual usage has evolved.

The underlying discipline this whole page is really about

Neither dial should be set reflexively or in isolation — the right combination depends on the actual task, the actual context (attended or not), and the actual consequences of a mistake in that specific situation. Working through both dials deliberately, every time, rather than defaulting to whatever combination is fastest to type or most familiar from habit, is the entire practical discipline this page and this site's broader sandbox coverage are built around.

A worked example across a single task's lifecycle

A single real task might reasonably move through several combinations as it progresses — starting under read-only with on-request approval simply to investigate and understand the problem, moving to workspace-write with on-request once you're ready for actual edits to begin, and potentially loosening to untrusted approval once you've seen several turns behave exactly as expected and want less interruption for the remainder. Watching a task through this lens — as a sequence of deliberate configuration choices rather than one fixed setting chosen at the very start and never revisited — produces a meaningfully safer and more efficient outcome than picking one combination up front and running the entire task under it regardless of how the task's actual needs evolve along the way.

Why writing down your own personal defaults helps

Beyond any single task, it's worth having your own personal, considered defaults for common situations — a typical trusted project, a typical unfamiliar one, a typical CI context — written down somewhere rather than re-derived from scratch every time a new task begins. Having genuine defaults ready to reach for doesn't mean abandoning the deliberate, per-task thinking this page recommends; it means that thinking has already happened once, carefully and deliberately, and simply needs confirming afresh against the specifics of whatever's actually sitting in front of you right now, today, for this particular task.