Codex --approve-for-me: Keep Auto Review Inside a Workspace-Write Sandbox

Separate the approval reviewer from the sandbox#

Codex exposes two controls that answer different questions:

The new flag changes the reviewer path, not the filesystem boundary. If a prompt or script needs access outside the workspace, automatic review does not make that request harmless; it changes how an eligible request is evaluated.

The official Codex sandboxing documentation describes the approval policies and sandbox modes. Read those settings together instead of treating “approve” and “sandbox” as synonyms.

Verify that the installed CLI supports the flag#

Release availability and the binary installed on a machine can differ. Check the local help and version before adding the flag to a shared script:

1
codex --version
2
codex --help | rg -- '--approve-for-me|--sandbox|--ask-for-approval'

If --approve-for-me is absent, update the CLI through the package or distribution channel used by that environment. Do not silently replace it with an unrestricted bypass flag just to make the command start.

For a human-reviewed session, omit the new flag and keep the approval policy visible:

1
codex --sandbox workspace-write --ask-for-approval on-request

The exact default policy can depend on the invocation context and configuration, so a team script should state the intended mode rather than rely on an inherited setting.

Handle non-interactive commands separately#

The Codex 0.147.0 release also removes the deprecated codex exec --full-auto path. For a scripted exec task, use the documented sandbox option instead of carrying the old alias forward:

1
codex exec --sandbox workspace-write "Run the repository's read-only checks and summarize failures."

That command still needs a task-appropriate policy. workspace-write permits the kind of repository edits many coding tasks require, but it does not mean that a script should be allowed to modify deployment credentials, system files, or unrelated directories. Keep destructive operations out of unattended prompts and review the exact command before adding automatic approval.

Add a small safety check to team workflows#

Before enabling automatic review in CI or a shared development script, record the intended boundary in the command or wrapper:

1
set -euo pipefail
2

3
codex --sandbox workspace-write --approve-for-me \
4
  "Inspect the current workspace, make only the requested source changes, and run the listed tests."

The wrapper should also define the working directory, avoid passing secrets in the prompt, and keep generated output inside a disposable checkout when the task is not fully trusted. Automatic review is a convenience for predictable work; it is not a substitute for narrowing the prompt or protecting the repository.

FAQ#