Approval policy: when it stops and asks

The sandbox decides what is possible. The approval policy decides what happens when the agent wants to do something the sandbox would refuse.

Two settings, and they are usually written together. One is the sandbox mode, one is the approval policy.

codex --sandbox read-only --ask-for-approval on-request

Or the same thing in the config file, which is where it belongs once you have decided:

sandbox_mode = "read-only"
approval_policy = "on-request"

What on-request means

With on-request, commands the sandbox already allows just run: they read files, and use the network if the profile permits it. The agent only stops and asks when it wants to do something outside those limits.

That is the pairing worth understanding. A narrow sandbox with on-request approvals is not a stream of interruptions, because most of what an agent does is reading.

The preset most people want

The docs call it Auto: writes allowed in the workspace, approvals on request.

codex --sandbox workspace-write --ask-for-approval on-request

One retired setting to know about

approval_policy = "untrusted" no longer exists, and leaving it in a config file can stop Codex starting. If you inherit a config from an older tutorial, that is the line to delete. The replacement for the stricter behaviour is a project entry:

[projects."/path/to/project"]
trust_level = "untrusted"

Commands then need approval unless a rule allows them, which is the next lesson but one.