Clarify Read Access Boundaries in Security Documentation (Related to #5237, #5474, #8396)

What is the type of issue?

Documentation is confusing

What is the issue?

Clarification Request: Read Access Boundaries in Codex Security Documentation

The current Codex security documentation explicitly defines:

• Write restrictions (workspace-limited by default)
• Network restrictions (disabled by default)
• Approval requirements for edits outside the workspace

However, it does not explicitly define the read access boundary.

The documentation states:

“In the Auto (default) preset, Codex can read files, make edits, and run commands in the workspace.”

It explicitly states that edits outside the workspace require approval.
It does not explicitly state whether reads outside the workspace:

• Require approval, or
• Are restricted at the sandbox level.

This ambiguity appears to be reflected in user reports such as:

• #5237 – Codex reading files outside the working directory without approval
• #5474 – Accessing files outside workspace in auto approval mode
• #8396 – Feature request to disallow reads outside workspace

Those issues suggest that read access behavior may not be clearly defined or enforced in the same way as write access.

---

Request

Please clarify in the official security documentation:

• Whether read access is restricted to the workspace in Auto / workspace-write modes.
• Whether reads outside the workspace require approval.
• Whether read boundaries are enforced at the OS sandbox level.

Clear documentation of the read boundary would eliminate ambiguity and align user expectations with actual behavior.

Where did you find it?

_No response_