How Codex works
A model that can only write text cannot change your repository. Codex is the part around the model that can, plus the boundary that decides how far.
A turn looks the same everywhere: you ask for something, the agent reads what it needs, runs commands, edits files, and checks its work. Every one of those actions goes through the sandbox, and anything the sandbox refuses becomes a question for you.
Four surfaces, one agent
| Surface | What it is for |
|---|---|
| The CLI | A terminal session. Everything is visible, which is why this course uses it |
| The IDE extension | The same agent inside VS Code and friends, with the diff in the editor |
| The desktop app | Longer work, files and projects, away from a terminal |
| Codex cloud | Runs on OpenAI's machines against your repository, without your laptop |
They share the configuration you will write in this course: the same AGENTS.md, the same rules, the same skills. Learning one is most of learning all four, and lesson 19 is the cloud.
The two controls that matter
The documentation separates them carefully and it is worth keeping the distinction: the sandbox defines technical boundaries, and the approval policy decides when the agent must stop and ask before crossing them.
- Sandbox: what is enforced by the operating system. The next lesson runs it.
- Approvals: what happens when the agent wants to go further. Lesson 5.
- Rules: the exceptions you write down, so a specific command may pass. Lesson 7.
By default the agent runs with network access turned off, and locally the sandbox limits what it can touch. Those are not annoyances to switch off: they are the reason it can keep working without asking you about every command.
- Decide which surface you will use day to day, then follow this course in the CLI anyway.
- Write down what you would be comfortable letting an agent do in your repository unattended. Keep it for lesson 4.
You understood something today that you didn't yesterday.