Codex beta permission restrictions are not disabled after asking for escalation

Codex version

Version 26.623.101652 • Released Jul 3, 2026
codex-cli 0.141.0

What subscription do you have?

Business

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

I'm on the security conscious side and love the concepts around rules, hooks and the new permission profiles. However, in addition to them being confusing in how they relate to each other and to the older sandboxing configuration, they don't seem to work properly for me.

More concretely: When a command is rightfully rejected and afterwards, codex asks to rerun with escalation and I approve, the restrictions still seem to be in place and the command fails just like in the sandbox.

This makes my more restrictive profile largely useless.
Switching profiles is not really an alternative either because the great strength of the approval workflow is approving the EXACT command codex wants to run.

What is the expected behavior?

After asking for approval, the one approved command should run completely outside of the sandbox restrictions.

Alternatively, codex could ask to escalate to another named sandbox profile, which would make the behaviour even more explicit.

Additional information

For context, these are all of my broadly permission-specific settings from config.toml:

default_permissions = "workspace-only"

[permissions.workspace-write-read-all]
extends = ":workspace"
[permissions.workspace-write-read-all.filesystem]
":tmpdir" = "deny"
":slash_tmp" = "deny"
"~/.codex-cache" = "write"
[permissions.workspace-write-read-all.network]
enabled = true
[permissions.workspace-write-read-all.network.domains]
"*" = "allow"

[permissions.workspace-only.filesystem]
#":root" = "deny"
":minimal" = "read"
":tmpdir" = "deny"
":slash_tmp" = "deny"
"~/.codex-cache" = "write"
"~/.codex" = "read"

"/opt/homebrew" = "read"
"~/.asdf" = "read"

"~/Development/ceres" = "read"
"~/.ceres" = "read"

"/Library/Developer/CommandLineTools" = "read"
"~/.gitconfig" = "read"
"~/.npmrc" = "read"

[permissions.workspace-only.filesystem.":workspace_roots"]
"." = "write"
".codex" = "read"
".git" = "read"
"module/**" = "read"
"system.sh" = "read"
# "frontend/src" = "write"
# "frontend/src/server" = "write"
# "api/generator-config" = "write"
# "api/specs" = "write"
# "api/openapi-spec.yml" = "write"
# "e2e-test/src" = "write"

[permissions.workspace-only.network]
enabled = true

[permissions.workspace-only.network.domains]
"redacted_internal_domain1" = "allow"
"redacted_internal_domain2" = "deny"

[shell_environment_policy]
set = {
  PATH = "/opt/homebrew/bin:/opt/homebrew/sbin:/Users/hrisser/.asdf/shims:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
  TMPDIR = "/Users/hrisser/.codex-cache/tmp",
  TEMP = "/Users/hrisser/.codex-cache/tmp",
  TMP = "/Users/hrisser/.codex-cache/tmp",
  GRADLE_USER_HOME = "/Users/hrisser/.codex-cache/gradle",
  GRADLE_OPTS = "-Dorg.gradle.daemon=false",
  npm_config_cache = "/Users/hrisser/.codex-cache/npm-cache",
  YARN_CACHE_FOLDER = "/Users/hrisser/.codex-cache/yarn-cache",
  MAVEN_OPTS = "-Dmaven.repo.local=/Users/hrisser/.codex-cache/m2",
  JAVA_TOOL_OPTIONS = "-Duser.home=/Users/hrisser/.codex-cache/home -Dmaven.repo.local=/Users/hrisser/.codex-cache/m2"
}