Separate command auto-approval from model-visible tool-use guidance

What variant of Codex are you using?

CLI, especially multi-agent / subagent workflows.

What feature would you like to see?

Please separate command execution auto-approval from model-visible tool-use guidance.

Today, approved exec-policy command prefixes are shown to the model as Approved command prefixes. This is useful as runtime policy: if a command is already needed and matches an approved prefix, Codex can run it without asking again.

The problem is that the model can also interpret the same list as commands it is allowed or encouraged to run directly.

This is especially confusing in multi-agent workflows. A command prefix may be approved for a specific subagent or agent_type, but the spawning agent and other subagents also see the same approved prefix. In practice, this can encourage the spawning agent to run the command directly instead of using the intended subagent.

It would be useful to have a supported way to:

• use approved prefixes for runtime auto-approval without presenting them as general tool-use guidance to every agent;
• scope approved prefixes to a specific subagent or agent_type when appropriate;
• avoid leaking those scoped approvals into the global model context.

Additional information

The core issue is that two concepts are currently mixed:

• "This command may run without another approval prompt if it is needed."
• "This agent should consider this command available for direct use."

Those are different policies. Treating approved command prefixes as model-visible context can blur that boundary and affect planning/delegation behavior.