Add time/use‑bounded approvals to reduce risk without prompt fatigue

What variant of Codex are you using?

cli

What feature would you like to see?

We need a middle ground between “always allow” and “prompt every time.” Today, users either get stuck in repeated prompts or accept permanent access that’s too risky for sensitive tools. Also, the risk of tools typically increases later in the session, because the agents has consumed more external (less trusted) context.

Proposal: extend AskForApproval with bounded permissions (time‑limited and/or use‑count limited). Users can allow a tool for N minutes or N uses, whichever expires first, and still keep “don’t ask again” if they want it.

Why this helps:

• Reduces prompt fatigue while preventing long‑lived, overly‑broad access.
• Limits blast radius for dangerous operations (least‑privilege, time‑boxed).
• Supports per‑tool/per‑MCP tool pair policies so read vs mutate behaviors can differ.
• Enables consistent UI + config + protocol behavior across CLI/TUI/app‑server.

This gives users finer control over risk without making workflows painful.

Additional information

I've made an example commit adding this functionality <https://github.com/openai/codex/compare/main...RichardoC:codex:new-permission-models> for anyone who wants to try this out