Separate approval policies for read vs write operations

Open 💬 3 comments Opened Sep 16, 2025 by dev-shinyu

What feature would you like to see?

Hi Codex CLI team 👋

Currently, the approval_policy setting applies uniformly to all command executions. This means we can either:

Allow all commands automatically (never),

Prompt before every command (on-request), or

Block/disallow entirely.

However, in real development workflows it would be extremely useful to distinguish read-only operations (e.g. searching, grepping, analyzing files) from write operations (e.g. creating, editing, or deleting files).

Proposal:
Introduce separate approval policies for read vs. write:

Read operations → allow automatic execution (no prompt).

Write operations → always require explicit approval.

This would give developers the convenience of seamless analysis and exploration, while still protecting against unintended or unsafe modifications to the workspace.

Example config idea:

sandbox_mode = "workspace-write"
approval_policy.read = "never"
approval_policy.write = "on-request"

This separation would significantly improve developer productivity and safety when using Codex CLI in real projects.

Thanks for considering this enhancement! 🙏

Are you interested in implementing this feature?

_No response_

Additional information

_No response_

View original on GitHub ↗

3 Comments

VladTheFrontender · 10 months ago

Yeah, I switched from Claude Code and immediately noticed this obvious major drawback.

adrianveen · 8 months ago

A whitelist of commands would be great. I don't need to be asked if i want to allow a cd command for example, or other completely safe shell commands.

alexisLefebvre · 4 months ago

I wanted to disallow Codex from writing files without my approval since I’m testing it, I put this in <kbd>~/.codex/config.toml</kbd>:

[projects."/home/user/works/org/project"]
trust_level = "untrusted"
sandbox_mode = "read-only"
approval_policy = "untrusted"

It should request escalation for every write operation, I didn't find a better way.

---

Here is the full explanation from Codex:

• These are per-project safety settings for the agent runtime:

  - trust_level = "untrusted"
    The project is treated as low-trust, so risky actions are restricted by default.
  - sandbox_mode = "read-only"
    The agent can read files but cannot modify files or run write operations in that project.
  - approval_policy = "untrusted"
    Commands outside the strict safe allowlist require explicit user approval before running.

  Together, this means: inspect-only by default, with manual approval needed for anything potentially impactful.

  In your current session, these exact values are not active (your environment shows workspace-write with unless-trusted).

This is very confusing.