Unclear interaction between approval mode and file edits
Open 💬 2 comments Opened Jan 16, 2026 by polyrand
💡 Likely answer: A maintainer (polyrand, contributor)
responded on this thread — see the highlighted reply below.
What is the type of issue?
Documentation is incorrect
What is the issue?
The codex security docs say this about running with --ask-for-approval untrusted:
Codex can read and edit files but asks for approval before running untrusted commands.
However, I find that codex keeps asking for permission to edit files, regardless of the sandbox mode.
With --sandbox workspace-write --ask-for-approval untrusted it doesn't do edits automatically, which is very inconvenient.
I prefer having a list of white-listed commands instead of letting the model decide when to ask for permission. But I can't seem to make it work. I haven't done a deep dive into how on-request is handled, but I still believe the current behaviour (and docs) is unclear.
Where did you find it?
_No response_
2 Comments
Actually, there seems to be a "TODO" comment for this:
https://github.com/openai/codex/blob/c26fe645393534c47b8ae5e03b6037c1dfc0d504/codex-rs/core/src/safety.rs#L81-L85
@oai-ragona (sorry for the tag, I assume this is you based on the comment).
Hi, just wanted to follow up on this. It doesn't have the expected behaviour based on the documentation, and makes it harder to use codex autonomously.