Directory / Codex CLI
Codex CLI
Separates sandbox mode from approval policy. Defaults to no network and writes limited to the workspace, enforced by Seatbelt on macOS and restricted tokens on Windows. Admins can pin allowed sandbox modes.
Lock this down first
Pin allowed_sandbox_modes to read-only and workspace-write so nobody can slip into danger-full-access.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | |
| Human approval gates | 3/3 | |
| Sandboxing | 3/3 | |
| Secrets handling | 2/3 | Credentials can live in the OS keyring (cli_auth_credentials_store). Default is a file in CODEX_HOME. |
| Audit logs | 2/3 | OTel log events include tool approval decisions and tool results. Export is off by default; prompts redacted unless enabled. |
| Kill switch / interrupt | Unverified | Only third-party docs describe Esc to interrupt. Not confirmed in official docs. |
| Network egress control | 3/3 | Network off by default in workspace-write. Optional proxy with domain allow and deny rules. |
Sources
- https://learn.chatgpt.com/docs/sandboxing
- https://learn.chatgpt.com/docs/agent-approvals-security
- https://developers.openai.com/codex/config-reference.md
- https://openai.com/index/running-codex-safely/
- https://github.com/openai/codex/blob/main/codex-rs/otel/README.md
- https://github.com/openai/codex/pull/2103
- https://github.com/openai/codex/blob/main/codex-rs/login/src/auth/storage.rs