codex upload ~/.codex/rules/default.rules even when sandbox_mode = "danger-full-access"

What version of Codex CLI is running?

codex-cli 0.137.0

I would like to understand why codex includes the contents of ~/.codex/rules/default.rules as part of the model input.

// ~/.codex/rules/default.rules
// example
prefix_rule(pattern=["curl", "-L"], decision="allow")
prefix_rule(pattern=["node", "scripts/open-chrome-window.js"], decision="allow")
prefix_rule(pattern=["open", "-a"], decision="allow")
prefix_rule(pattern=["npm", "run", "build:wx"], decision="allow")
prefix_rule(pattern=["rtk", "mkdir"], decision="allow")
prefix_rule(pattern=["rtk", "cp"], decision="allow")
prefix_rule(pattern=["rtk", "git"], decision="allow")

Does the model need to rely on this file in order to generate commands with the correct permissions?

Why is this handled by providing the rules to the model, instead of enforcing the restrictions only at execution time?

input like:

<permissions instructions>
...

### Examples
...

## Approved command prefixes
The following prefix rules have already been approved: - ["rtk", "cp"]
- ["curl", "-L"]
- ["open", "-a"]
- ["rtk", "git"]
- ["rtk", "mkdir"]
- ["node", "scripts/open-chrome-window.js"]
- ["npm", "run", "build:wx"]
</permissions instructions>

In addition, even though I have already set:

sandbox_mode = "danger-full-access"

Codex still uploaded the contents of ~/.codex/rules/default.rules.

Could you clarify the intended behavior here? Is this expected, or should the rules file not be uploaded when full access mode is enabled?

Thanks.