Public web-sourced fact-check payloads are blocked as data exfiltration, breaking second-model review workflows

Summary

A Codex workflow that fact-checks user-facing copy with a second model is blocked because the policy treats the review payload as external data exfiltration, even when the payload is composed from public web search results and the user explicitly authorizes sending it to the selected external review model.

This is not a request to upload private files. The workflow collects public web sources, builds a small claim/source summary plus a draft, and asks a second model to verify whether the draft is supported by those public sources.

Why this matters

For editorial and publishing workflows, a second-model fact check is a hard gate before writing final artifacts. The safer workflow is:

1. Search public web sources
2. Build a draft and structured fact packet in memory
3. Send only the public-source fact packet and draft summary to a user-selected second model
4. Write final files only after the second model passes the audit

The current behavior blocks step 3 as data exfiltration. That makes the safer zero-disk workflow impossible and can push agents toward worse patterns, such as writing intermediate drafts or evidence packets locally before review.

Observed behavior

When attempting to send an in-memory review payload to a Gemini profile through an automated reviewer CLI, Codex blocked the action as unacceptable external data exfiltration. The block applied even after the user explicitly approved sending the public web-sourced fact-check payload to Gemini for second review.

No private workspace files needed to be uploaded. The payload consisted of:

• Public source URLs
• Claims derived from those public web pages
• A draft based on those public claims
• A request for a second model to verify factual support and localization issues

Expected behavior

Codex should provide a policy-recognized way to run second-model fact review on public web-sourced material, for example:

• A scoped allow path for user-approved public-source fact-check payloads
• A first-class second-model review tool that records audit boundaries
• A way to classify payloads as public-web-derived rather than private workspace data
• A policy-safe in-memory review channel that does not require writing intermediate draft/fact files to disk

Constraints that should be preserved

• Do not allow arbitrary private file exfiltration
• Do not allow agents to bypass policy through indirect upload paths
• Keep user approval explicit and auditable
• Preserve a zero-disk pre-audit workflow: draft, fact packet, and source map should not have to be written before the second-model audit passes

Impact

This blocks automated editorial fact-checking workflows where users require second-model validation before final file generation. The information being checked is public web information, but the current policy path treats the review payload the same as private data exfiltration