Approval policy untrusted should work with sandbox workspace_write
Open 💬 0 comments Opened Jul 27, 2026 by yiteng-guo
What version of Codex CLI is running?
codex-cli 0.145.0
What subscription do you have?
API
Which model were you using?
_No response_
What platform is your computer?
_No response_
What terminal emulator and version are you using (if applicable)?
_No response_
Codex doctor report
What issue are you seeing?
Currently when approval_policy = "unstrusted" and sandbox_mode = "workspace-write" are used, it will prompt any "safe"/"trusted" command (e.g. apply_patch) that modifies the workspace files. It effectively becomes untrusted + read-only.
Per codex documentation, approval_policy and sandbox_box are orthogonal so I think the correct behaviors are that
untrusted + workspace-write: "trusted" tools should respect sandbox rules and be allowed to write inside the sandbox. For any write outside the sandbox, it will hit an error and ask for an approval.untrusted + danger-full-access: "trusted" tools are able to write anywhere.
However in both cases, for "untrusted" tools (e.g. curl, wget), it should always be blocked and prompts users for approvals.
It's worth noting that this is actually mentioned in this todo and removing that entire match will achieve what I describe above. I've tested that locally.
What steps can reproduce the bug?
See above.
What is the expected behavior?
_No response_
Additional information
_No response_