Field guide / 13 min
Test commands in the sandbox and audit execpolicy
Observe filesystem denials and rule decisions before relying on them as guardrails.
codex sandbox runs a command inside a Codex-provided sandbox and can resolve a named permission profile, narrow readable roots or network, and log macOS denials. execpolicy check evaluates a command against rule files and explains the decision. These tools diagnose and test authority; they do not make an unsafe command safe or replace operating-system enforcement.
Verified terminal sequence
- $
codex sandbox --permission-profile PROFILE -- command --arg - $
codex sandbox --log-denials -- command --arg - $
codex execpolicy check --pretty --rules ~/.codex/rules/default.rules -- gh pr view 7888
Working principles
Enforcement and policy differ
The sandbox constrains the process at the OS boundary. Execpolicy classifies command intent; keep both results visible.
Profiles must resolve in context
Working directory, config layers, and managed requirements affect the active permission profile. Test where the real command will run.
Denials are evidence
A denial log can reveal the missing capability. Narrow the profile rather than disabling protection wholesale.
Field procedure
- 01
Choose a minimal probe
Use a non-destructive command that touches only the capability under test and produces an observable success or denial.
- 02
Resolve the intended profile
Set -C and the exact profile; include managed configuration only when the production path does so.
- 03
Capture denials
On supported macOS setups, use --log-denials and review paths before sharing because local directory names can be sensitive.
- 04
Evaluate command rules
Run execpolicy check with the same argv shape the agent would request. Inspect the matched rule and decision.
- 05
Test negative cases
Prove both the required command succeeds and a neighboring disallowed command remains denied.
PASS / FAIL
Acceptance checklist
- The probe is harmless and scoped.
- Effective profile and working directory are recorded.
- Sandbox and execpolicy outcomes are not conflated.
- Negative tests remain denied.
- No rule grants a broad shell wildcard accidentally.
WATCH / REJECT
Failure patterns
- Turning on danger-full-access to silence one denial.
- Testing a different argv shape from production.
- Treating hidden or evolving execpolicy behavior as a permanent API.