Approval Policy "Never" says it runs without approval but blocks Computer Use approvals

What version of the Codex App are you using (From “About Codex” dialog)?

26.422.30944 (build 2080)

What subscription do you have?

Personal account / not sure; no Workspace settings or Admin area visible in Codex Desktop.

What platform is your computer?

Darwin 25.4.0 arm64 arm (macOS 26.4.1 build 25E253)

What issue are you seeing?

In Codex Desktop settings, Approval Policy "Never" is described as:

Run without asking for approval

This reads like actions will run automatically without prompting. In practice, when using the Computer Use plugin, approval-elicited actions fail immediately and no approval dialog appears.

Exact errors observed:

Computer Use approval denied via MCP elicitation for app 'com.apple.calculator'.
Computer Use approval denied via MCP elicitation for app 'com.apple.podcasts'.
Computer Use approval denied via MCP elicitation for app 'com.apple.finder'.

This makes "Never" look like the most permissive option, but the actual behavior appears to be "never allow approvals" / deny any approval-elicited action. This was confusing enough to block use of Computer Use for several days until the approval policy was changed away from "Never".

What steps can reproduce the bug?

1. Open Codex Desktop settings.
2. Set Approval Policy to Never.
3. Note that the UI description says Run without asking for approval.
4. Ask Computer Use to control a local app, for example:

• open Calculator and enter 2+2
• open Podcasts
• inspect Finder

1. Observe that no approval prompt appears and the action fails immediately with Computer Use approval denied via MCP elicitation ....
2. Change Approval Policy away from Never to a policy that allows prompting/approval.
3. Repeat a Computer Use action. It works after the policy is changed.

What is the expected behavior?

Either the behavior or the UI copy should be changed so the policy is unambiguous.

If Never is intended to mean "do not ask and deny approval-required actions", the description should say that clearly, for example:

Never ask for approval. Actions requiring approval will be blocked.

If Run without asking for approval is the intended meaning, then Computer Use approval prompts should be auto-approved instead of failing immediately.

The current copy makes Never sound like an auto-approve/permissive mode, while the observed behavior is restrictive for approval-elicited actions.

Additional information

Approximate first failing attempts: April 24, 2026 around 15:40-15:45, Asia/Shanghai timezone.

The full Approval Policy dropdown options shown in Codex Desktop are:

• Untrusted
• On Request
• On Failure
• Never

The confusing option is:

Never
Run without asking for approval

The settings screenshot also shows Sandbox setting: Workspace write, and network access enabled. I understand that the sandbox setting is execution sandboxing and does not necessarily indicate a Business/Enterprise workspace.

I searched existing issues for Approval Policy, Run without asking for approval, and approval denied via MCP elicitation; I did not find an exact duplicate for this copy/UX issue.

A screenshot of the full settings panel showing Approval Policy: Never and the description is available and can be attached.

<img width="830" height="353" alt="Image" src="https://github.com/user-attachments/assets/5eb6fe2a-a9d7-451a-8424-d8e7a18c4abb" />