Field guide / 14 min
Set authority before autonomy
Sandbox, approvals, web search, and command network access are separate controls.
Codex security is the combination of an OS-enforced sandbox and an approval policy. Workspace-write with on-request approvals is a practical local default; read-only is for inspection and planning. Web search does not automatically grant network access to spawned commands.
Verified terminal sequence
- $
codex --sandbox read-only --ask-for-approval on-request - $
codex --sandbox workspace-write --ask-for-approval on-request - $
codex --search - $
codex -c 'sandbox_workspace_write.network_access=true'
Working principles
Sandbox is capability
It determines where generated commands can read, write, and connect.
Approval is interruption
It determines when Codex must stop and ask; disabling prompts does not widen the sandbox by itself.
Network has two surfaces
The web-search tool and subprocess network access have distinct settings and prompt-injection risks.
Field procedure
- 01
Classify the task
Use read-only for analysis, workspace-write for normal repository edits, and reserve full access for externally isolated environments.
- 02
Start explicitly
Launch with the sandbox and approval flags when teaching or auditing behavior so the boundary is visible.
- 03
Inspect writable roots
Use /status to confirm the workspace. Add a directory narrowly instead of broadening to the whole machine.
- 04
Enable only required network
Use live search when freshness matters. Enable command network separately only for commands that truly need it.
- 05
Review escalation
Read the exact command, destination, and justification; approve the smallest useful scope.
PASS / FAIL
Acceptance checklist
- Sandbox matches the task.
- Approval mode is intentional.
- Writable roots contain no unrelated repository.
- Network access is off unless justified.
WATCH / REJECT
Failure patterns
- Teaching --yolo as a convenience default.
- Confusing --search with shell network access.
- Approving a broad command because its description sounds safe.