Automations With Full Permissions
Open 💬 9 comments Opened Apr 17, 2026 by markymark2001
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What variant of Codex are you using?
App
What feature would you like to see?
I want to run automations with unrestricted permissions. Yes, I know it is unresponsible but please 🥺🥺🥺....
And btw - rules configuration should be easier on automations. I tried to config them for my needs, and failed multiple times...
Additional information
_No response_
9 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
You might be interested in the new heartbeat automation type. It allows you to create an automation that targets an existing thread rather than creating a new thread. You can adjust the permissions for the target thread.
Ohh, I can make this work for me indeed. thank you @etraut-openai
Its seems like a duplicate as well, hence will close it
Heartbeat doesn't solve this @etraut-openai - I also left a comment on https://github.com/openai/codex/issues/16695 as it might be related.
Here is reasoning:
Issue is that even though heartbeats inherit thread permissions, they have previous context in them which is a big downside for code review tasks. It errs the model to be lazy and focus on same issues instead of attacking new ones with fresh context - see screenshot attached.
Prompting isn't too helpful either - I can bypass the screenshot situation but the model is still steered toward older issues and doesn't truly do what it needs to.....
<img width="824" height="278" alt="Image" src="https://github.com/user-attachments/assets/a452d2e4-a801-4c95-8c82-ba8e43bb3bc4" />
@markymark2001, if you want fresh context, you could have the automation prompt specify that it should use a subagent to do your review. It will post its results back to the parent thread when it's complete.
@etraut-openai
Its exactly what I have been doing actually. But result still feels icky because what i feel is happening is the main agent biases the subagent prompt based on its context. One way would be to hard code the subagent prompts but I just feel like this is too complicated for no reason. And it takes me like 4 automation runs to figure out the prompt to make this work when it should be very straightforward.
PS: see another screenshot - here it explicitly didn't bother calling subagents at all, it just said that the codebase is completely ok by just checking git diff.... And you can see my prompt as well 🤷🏻♂️
I think yes - I can make it work. But is this optimal UX for future? hell nah, its painful setup every time
<img width="896" height="503" alt="Image" src="https://github.com/user-attachments/assets/f42bb277-6334-4108-8248-b56c976e5833" />
@etraut-openai at the very least please allow automations to use Auto-review feature.
It's just baffling how automations can't really do anything without tripping the sandbox restrictions even if you explicitly choose to disable as many guardrails as possible via app settings (e.g. approval policy = never, sandbox settings = full access).
Even something as basic as backing up some files to another directory simply doesn't work right now (getting "this run could not perform the requested sync because the session is in a read-only sandbox").
@etraut-openai
Same issue here. My thread has full access, but heartbeat automations still ask for permission for routine actions like git operations and network access. If automations cannot inherit full-access permissions or expose their own permission settings clearly, they cannot really run autonomously, which defeats the point of using automations.
My workaround:
adding "sleep until tomorrow 9 am." / "sleep for 2 hrs." at the end of the heartbeat instruction, and paste them directly into the threads multiple times. Stupid as fucked but works.