Task-led permissions guide · official OpenAI docs checked Nov 3, 2026
What can Codex CLI read, change, or run in each permission mode?
Choose Codex CLI sandbox and approval settings by operation: reading a repository, editing workspace files, accessing extra directories, running network-dependent commands, or working without a sandbox.
What is the difference between sandbox mode and approval policy?
Sandbox mode selects the filesystem and command boundary for model-generated shell commands. Approval policy controls when Codex pauses for a human before running a command. Think of them as separate choices: where an operation may run, and whether it needs a prompt. OpenAI documents both as distinct CLI flags. The actual behavior can also depend on the operating system, CLI version, active configuration, and execution surface; check the effective mode in your session.
Which mode should I use to inspect a repository without edits?
Use `--sandbox read-only` when the task is inspection and you do not want model-generated commands to modify files. If you also want command execution to pause for human review where applicable, set `--ask-for-approval on-request`. These settings describe the CLI mode; verify the behavior in the current session and avoid testing against important files.
How do I let Codex edit files in the current workspace?
For a task whose changes should stay within the project workspace, OpenAI documents `--sandbox workspace-write --ask-for-approval on-request` as a low-friction local workflow. Workspace-write grants file-writing scope in the workspace; on-request controls approval prompts. Review the full diff and command output. It does not mean every possible operation is automatically permitted.
What if a task needs another directory?
The CLI reference documents `--add-dir <path>` as granting additional directories write access alongside the main workspace; it can be repeated. Prefer adding only the specific directory the task needs, then check the path and resulting diff. Do not switch to `danger-full-access` just to reach one extra directory.
What should I do when a command needs network or access outside the workspace?
Treat the blocked operation as a request to understand, not a reason to immediately widen all permissions. Check the command, destination, and data it would send or change; then decide whether the task actually needs that access. The CLI exposes approval and sandbox options, but network controls can depend on configuration and platform. If you need a wider write path, the CLI documents `--add-dir`; if you need an isolated full-access run, use a disposable, externally contained environment.
When is danger-full-access appropriate?
`danger-full-access` removes the Codex CLI sandbox boundary for model-generated commands. The CLI reference describes `--dangerously-bypass-approvals-and-sandbox` (also `--yolo`) as bypassing both approvals and sandboxing, and says to use it only inside an externally hardened environment. These are broader than granting an additional project folder; avoid them for ordinary local work.
How can I check which permissions are active?
In the interactive CLI, use `/permissions` to inspect or change the permission preset. The developer command reference also describes `/status` as a way to inspect session status. Before an important run, confirm the displayed mode and use a disposable repository with harmless read, write, and blocked-path probes. If the effective setting differs from your intended configuration, stop and resolve the mismatch before continuing.
Does a public permission report prove Codex has a sandbox bug?
No. A public GitHub issue filed October 10, 2026 reports a Windows VS Code extension session where the reporter expected `read-only` but observed `workspace-write`. It documents one user's reported environment and is not evidence that the behavior is widespread, independently reproduced, or present in the CLI. Use it as a reminder to verify the effective mode on your own installed surface.
What is the practical default for a bounded local coding task?
Start with `--sandbox workspace-write --ask-for-approval on-request` when the task needs edits within the project and you want approval prompts for actions requiring them. Use `read-only` for inspection. Grant an extra directory narrowly with `--add-dir` only when needed. Keep full sandbox bypass for an isolated environment, and inspect changes before accepting them.
Does this guide rate Codex CLI security or coding quality?
No. It explains documented permission controls and a way to verify your setup. It is not a security audit, guarantee, quality benchmark, or comparison with another coding agent. Product interfaces and flags can change; the linked official CLI documentation was checked November 3, 2026.
Sources
- OpenAI Codex CLI developer command reference · sandbox, approval, add-dir and yolo flags · checked Nov 3, 2026
- OpenAI Codex security documentation · sandbox and approval concepts · checked Nov 3, 2026
- OpenAI Codex CLI overview · interactive permissions and /status · checked Nov 3, 2026
- OpenAI Codex public issue #52809 · one Windows VS Code user's reported effective-mode mismatch · filed Oct 10, 2026
- r/OpenaiCodex discussion: repeated approval prompts and sandbox choices · qualitative user report · checked Nov 3, 2026