Directory / Codex CLI
Codex CLI
Separates sandbox mode from approval policy. Defaults to no network and writes limited to the workspace, enforced natively on each OS. Admins can pin allowed sandbox modes.
Lock this down first
Pin allowed_sandbox_modes to read-only and workspace-write so nobody can slip into danger-full-access.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | Sandbox modes plus approval policies; admins can restrict allowed_sandbox_modes. |
| Human approval gates | 3/3 | on-request asks before leaving the sandbox; read-only asks before edits and commands. |
| Sandboxing | 3/3 | OS-enforced sandbox; workspace-write limits writes to the workspace by default. |
| Secrets handling | 2/3 | Credentials can live in the OS keyring (cli_auth_credentials_store). Default is a file in CODEX_HOME. |
| Audit logs | 2/3 | OTel log events include tool approval decisions and tool results. Export is off by default; prompts redacted unless enabled. |
| Kill switch / interrupt | Unverified | Only third-party docs describe Esc to interrupt. Not confirmed in official docs. |
| Network egress control | 3/3 | Network off by default in workspace-write. Optional proxy with domain allow and deny rules. |
Sources
- https://learn.chatgpt.com/docs/sandboxing
- https://learn.chatgpt.com/docs/agent-approvals-security
- https://learn.chatgpt.com/docs/config-file/config-reference.md
- https://openai.com/index/running-codex-safely/
- https://github.com/openai/codex/blob/main/codex-rs/otel/README.md
- https://github.com/openai/codex/pull/2103
- https://github.com/openai/codex/blob/main/codex-rs/login/src/auth/storage.rs
Vendor? Request a correction. We review corrections within 7 days.