Both Claude Code and Codex separate guidance from enforcement. Instruction files guide, while permission rules, sandboxes and admin policy constrain. This checklist maps the concepts between the two, using only each vendor's documentation, so a team running both can write one policy and apply it twice.
Instructions
- Claude Code: CLAUDE.md in managed, user, project and local scopes, concatenated root first, plus path-scoped rules. The docs call it context, not enforcement.
- Codex: AGENTS.md from a global file down through the repository, one file per directory, with a 32 KiB combined default cap.
Action: keep one short source of truth. Claude Code can read a repository's AGENTS.md in place of CLAUDE.md, per its memory docs.
Approvals and permissions
- Claude Code: modes from default through bypass, plus deny, ask and allow rules evaluated in that order.
- Codex: a sandbox mode plus an approval policy, with command rules where the strictest decision wins.
Action: define what is always denied, what asks, and what is allowed, then express it in each tool's format.
Sandboxing
- Claude Code: an OS sandbox for shell commands with filesystem and network isolation. File tools, MCP servers and hooks run outside it.
- Codex: read-only, workspace-write and danger-full-access, with network off by default and protected paths such as
.git.
Action: confirm what each sandbox does not cover before relying on it.
Memory
- Claude Code: auto memory, loaded each session up to a size cap.
- Codex: memories, off by default, stored locally.
Action: decide whether durable memory is allowed for sensitive repositories.
Admin policy
- Claude Code: managed settings by file, MDM or server, ranked above user settings.
- Codex: requirements that users cannot override, plus overridable defaults.
Action: put guardrails in the enforced layer in both.
Visibility
- Claude Code: OpenTelemetry metrics and events, with prompt text redacted by default, and admin analytics.
- Codex: workspace analytics, an analytics API, and a Compliance API. The docs warn that conversation visibility alone does not establish a complete record of local actions.
Action: do not treat chat logs as an audit trail for what ran on a laptop.
Gaps to check yourself
Features and plan availability change often. Verify each item against the current documentation for your plan before you write it into policy.
How Safeguard fits
Controls on the agent are one layer. Safeguard checks what the agent adds to your code, with dependency scanning, policies, gates and guardrails, and an MCP Guardrail for tool access. You can start with the free scan at gold.safeguard.sh/scan.
Quick check
Should one instruction file serve both tools?
It can. Claude Code can read AGENTS.md in place of CLAUDE.md, so one short file can serve both.
Where should hard limits live?
In enforced layers: deny rules and managed settings in Claude Code, requirements in Codex.
Sources
- How Claude remembers your project
- Configure permissions
- Deploy managed settings
- Custom instructions with AGENTS.md
- Agent approvals and security
- Managed configuration
- Governance
Last reviewed: 19 October 2026.
