Allow exec rules to grant bounded permissions to matching commands

What variant of Codex are you using?

Codex CLI and App. This concerns shared command execution and permission profiles.

What feature would you like to see?

Let an exec rule assign bounded permissions to a matching command and its child processes.

Permission profiles currently apply filesystem and network access to every sandboxed command in a task. Exec rules match specific commands but cannot grant command-scoped access.

Illustrative syntax:

prefix_rule(
    pattern = ["build-tool"],
    decision = "prompt",
    execution_permissions = "build-tool",
)

The named profile could grant access to one cache, metadata directory, socket, or network destination.

Required behavior:

• Keep the command sandboxed.
• Apply the profile only to the matched process tree.
• Keep unrelated commands on the task's baseline profile.
• Keep allow, prompt, and forbidden independent from sandbox permissions.
• Preserve managed restrictions; deny rules still win.
• Show added permissions in approval prompts and audit records.
• Fail closed for ambiguous shell wrappers or compound commands.

Why is this useful?

Development tools often need state outside the workspace. Examples include Git metadata, build caches, package-manager caches, and local service sockets.

Current options are too broad:

1. Grant access task-wide, allowing every command to use it.
2. Run the command outside the sandbox, allowing everything available to the host user.
3. Redirect state to temporary locations, losing reuse and requiring tool-specific workarounds.

Command-scoped permissions would preserve sandbox enforcement while granting only required resources.

Related work

• #24115: ordinary Git writes versus dangerous metadata manipulation.
• #12283: command-specific sandbox behavior for build-tool state.
• #20917: per-command sandbox exclusion; broader because it runs commands outside the sandbox.
• PR #12748: prototype for skill-specific writable roots.
• PR #29500: rules scoped to an already-active profile; this request instead selects bounded permissions for a matching command.

Permission-profile documentation: https://learn.chatgpt.com/docs/permissions