Codex asks for permission despite full access and approval prompts disabled

Summary

Codex repeatedly asks the user for permission before ordinary actions even when the thread is configured with full filesystem access and approval prompts disabled.

User impact

This breaks flow across threads. The user expects Codex to proceed with normal local reads, edits, commands, and safe local commands, but the assistant keeps interrupting to ask for permission.

Observed behavior

• In multiple Codex threads, the assistant asks for permission before continuing.
• This happens even when the session has unrestricted filesystem access.
• This happens even when approval prompts should not be requested.
• In the current thread, the assistant had to be corrected with: "you have full acces why do you keep asking for permission" and then clarified that this is happening "in all my threads".

Expected behavior

When a thread has full access and approval prompts disabled, Codex should proceed without asking for permission for ordinary, non-destructive local work.

Codex should still ask for explicit confirmation for actions with major external or destructive consequences, such as:

• deleting user data
• force-resetting git history
• sending email
• publishing changes
• modifying calendars or external accounts
• making irreversible changes outside the requested scope

Environment evidence from current thread

• Surface: Codex desktop app, projectless local thread
• Date observed: 2026-06-20
• Filesystem access: unrestricted / full access
• Approval behavior expected: no approval prompts for shell commands
• Active permission profile presented to the assistant included unrestricted filesystem access and instructions not to request escalation.

Likely cause

The assistant appears to be over-applying a permission-request behavior despite the active thread configuration. This may be one of:

• model behavior not honoring the current approval policy
• stale permission assumptions carried across threads
• UI/tooling exposing full access while the assistant still believes approval is required
• conflicting instruction handling around tool safety

Reproduction steps

1. Open a Codex thread configured with full filesystem access.
2. Ensure approval prompts are disabled / not required.
3. Ask Codex to perform ordinary local work, such as reading files, editing a file, running a safe command, or installing a local dependency.
4. Observe that Codex asks for permission anyway.

Requested fix

Codex should align its behavior with the active permission profile:

• If approval prompts are disabled, do not ask for approval for ordinary local operations.
• Only ask for confirmation when the action itself is destructive, externally visible, or irreversible.
• Make the assistant aware that approval_policy=never means it should not request escalation or permission prompts.