Codex controls what an agent can do with two separate settings. The sandbox mode sets what it can technically touch. The approval policy sets when it must ask before going beyond that. Network access is off by default, and the recommended preset for a version-controlled folder is workspace-write with on-request approvals.
Sandbox modes
From OpenAI's Codex security documentation:
read-only: Codex can read files and run commands within the sandbox. Actions outside it can require approval.workspace-write: Codex can edit files and run commands in the workspace. The Auto preset uses this mode.danger-full-access: no sandbox. The docs advise caution.
Approval policies
on-request: Codex asks before leaving the sandbox, using network access, or running commands outside a trusted set.never: Codex never prompts. Commands still run within the chosen sandbox mode.granular: keeps specific approval categories interactive and auto-rejects others.untrustedis retired. Clients may fail to start if it is set, so remove it from configs and managed defaults.- An approvals reviewer setting can route eligible requests to a reviewer agent instead of you.
The key point: never does not mean unrestricted. It means no prompts inside whatever sandbox you chose. The risky combination is a full-access sandbox with no approvals.
Network
The docs state that by default the agent runs with network access turned off. In workspace-write mode you can turn it on with a setting in the sandbox section of the config file. A network proxy feature can constrain enabled access with domain rules, but it does not grant access by itself. Web search defaults to cached results, and the page says to treat web results as untrusted.
Protected paths
Inside writable roots in workspace-write mode, these stay read-only recursively: the .git directory or file, and .agents, .codex and .aws when they exist as directories. That blocks an agent from rewriting its own configuration or your cloud credentials folder from within the workspace.
Recommended settings
For version-controlled folders, use Auto, which is workspace-write with on-request approvals. For folders not under version control, the docs recommend read-only. The explicit command forms:
codex --sandbox workspace-write --ask-for-approval on-request
codex --sandbox read-only --ask-for-approval on-request
Why the version control point matters
Auto is recommended where Git can show and revert what changed. Without that safety net, start read-only and approve writes one at a time.
Pairing with rules
Sandbox and approvals set the baseline. Command rules, covered separately, decide which specific commands may run outside the sandbox, and admins can pin allowed values in managed requirements.
Quick check
Does the never approval policy remove the sandbox?
No. Commands still run within the chosen sandbox mode. It only stops the prompts.
Is network access on by default?
No. It is off by default and must be enabled in workspace-write mode.
Sources
Last reviewed: 19 October 2026.
