Two settings decide what Codex does while you are not watching: the sandbox says where its commands may write, and the approval policy says when it stops to ask you. Set one without the other and you get either a Codex that asks about everything or one that can reach more than you meant. This lesson sets both in a few minutes.
Open Sandbox and approvals
Open Config Studio for Codex and press Sandbox and approvals in the list on the left. The panel says it in one line: approval decides what Codex may attempt; the sandbox decides what is reachable when an approval was wrong.
Nothing is picked yet, so the right column has nothing to write and Codex keeps its own defaults. Each answer you pick below adds its line, sandbox_mode or approval_policy, and nothing else.
Choose where commands may write
Under Sandbox, Where commands may write has three answers:
- read-only: read anything, write nothing. For looking around a codebase.
- workspace-write: write inside the workspace and
/tmp. The default in a git repository;.git,.codexand.agentsstay read-only either way. - danger-full-access: no sandbox at all, the same as
--yolo. Only for a throwaway machine.
Also writable adds folders outside the workspace, one per line. Each one is a hole in the boundary, so keep the list short.
Choose when it stops to ask
Under Approvals, When it stops to ask has three answers:
- on-request: Codex asks before it leaves the sandbox, touches the network or works outside the workspace. The usual choice.
- never: it never asks, and anything the sandbox blocks fails. Use it only with a sandbox you trust, such as in CI.
- granular: you choose which kinds of prompt may reach you.
Pick granular prompts
With granular picked, five switches appear: Ask to leave the sandbox, Ask when a rule says prompt, Let MCP servers ask questions, Let it ask for more permissions and Ask before a skill’s script runs. A switch that is off means that kind of request is declined without asking you. The file on the right gets an [approval_policy.granular] table with the switches you set.
Who answers the prompts can send each request to a reviewer agent first (auto_review): it lets low and medium risk through, refuses critical requests and asks you only about high risk.
Decide about the network
Commands in the sandbox cannot reach the network. Allow network access in the sandbox opens it for every command and every host. If you only need a few hosts, leave it off and use a permission profile instead.
Or write one permission profile
Press Permission profiles. A profile puts files and network in one named place. Type a Profile name, keep Start from on :workspace so its protections carry over, and leave Make it the default on. Then:
- Inside each workspace root: one rule a line, such as
**/*.env = deny. - Network for commands and Domains:
api.openai.com = allow, one host a line. A deny always wins.
The file gets a [permissions.<name>] table and default_permissions, so every session uses it. Use a profile or sandbox_mode for a session, not both.
Next: which Codex config layer wins, when the same key is set in more than one place.