The call
Approve Codex with the Auto preset enforced through requirements.toml, network access allowlisted through the proxy, and danger-full-access limited to isolated CI runners.
Then review every cloud environment's internet access and secrets one by one.
Approving Codex means approving two systems. On laptops, the sandbox and approval policy you enforce decide what model-generated commands can touch. In Codex Cloud, each OpenAI-hosted environment sets its own internet access and secrets and ignores device policy. This checklist covers both, from OpenAI's agent security and managed configuration documentation.
When you need this
- Security has to approve Codex before it reaches more engineers.
- Some engineers already run Codex with approvals off or full access.
- Codex Cloud environments need credentials for package registries or internal services.
- You need to show auditors which settings are enforced and which are only defaults.
Worked example: two policies for one company
Laptops
Ship requirements.toml through MDM so every local client starts in workspace-write with on-request approvals and network access off, and users cannot override it. XING manages Codex defaults centrally on every laptop this way.
CI
Allow danger-full-access only on isolated CI runners or containers, the controlled environments OpenAI names, and sign CI in with an API key.
Cloud
Review each Codex Cloud environment on its own, because none of the laptop policy reaches it.
Audit
Record who may disable approvals or leave the sandbox, and pull audit records from the Compliance API on Enterprise.
Evaluation criteria
Start from the defaults
What can Codex touch on a developer's machine out of the box?
Look forIn a version-controlled folder, Codex recommends the Auto preset, which pairs a workspace-write sandbox with on-request approvals and network access off. Git metadata stays read-only inside writable roots, as do the .agents and .codex folders. Folders outside version control start read-only.
Enforce settings with requirements
Which settings can a user change, and which are locked?
Look forThe requirements.toml file constrains approval policy, sandbox mode, permission profiles, web search mode, managed hooks, MCP servers, and plugin sources, and users cannot override it. For Codex 0.138.0 or later, OpenAI recommends allowed_permission_profiles with a managed default_permissions. Deliver requirements through the system file, Agent Security in the Admin Console, or macOS MDM. Remove the retired approval_policy = "untrusted", which can stop clients from starting.
Constrain the network
When commands need the network, which destinations can they reach?
Look forRoute commands through the network proxy, which applies allowlist-first domain rules. Deny always wins, and local and private addresses stay blocked by default. Web search uses an OpenAI-maintained cache by default and switches to live results under full access. The proxy does not filter web search, connectors, MCP servers, browser use, or cloud tasks, so govern each of those with its own control.
Decide who runs without guardrails
Who, if anyone, may turn approvals off or leave the sandbox?
Look forWrite down who can disable approvals or leave the sandbox. The --ask-for-approval never flag removes prompts. OpenAI limits danger-full-access to controlled environments such as isolated CI runners or containers. App or MCP calls marked destructive still require approval. NVIDIA gives every employee an agent VM with read-only production access.
Review Codex Cloud on its own
What can a cloud task reach, and which secrets does it hold?
Look forCloud environments do not inherit local device policy, MDM settings, or local network access. Each environment sets its own internet access and network secrets, and saving a network secret adds its domains to restricted internet access. An allowed domain in Agent Security does not override a restriction in the environment's settings.
Match sign-in to data policy
Which data terms apply to each engineer's Codex usage?
Look forChatGPT sign-in applies workspace RBAC and Enterprise retention and residency settings. An API key applies the API organization's retention and data-sharing settings instead. GPT-6 Astra runs with safety monitoring that can pause a task. Under zero data retention or non-US data residency, a paused task ends without findings or a resume option.
Questions to ask vendors
- Which of our requirements are enforced on client versions older than 0.138.0?
- Which traffic sits outside the command network proxy in our deployment, and which control governs each?
- Who can view or change network secrets saved to a shared cloud environment?
- Compliance API records do not cover every local action, so which local telemetry and hook logs do we collect beside them?
Red flags
- Full access or --yolo on laptops that hold production credentials.
- Cloud environments with unrestricted internet access and production secrets.
- The retired untrusted approval policy still in managed defaults or startup scripts.
- MCP servers enabled with no allowlist.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 2
- Codex docs: Agent approvals & security
- Codex docs: Sandboxing
- Codex docs: Managed configuration
- Codex docs: Non-interactive mode
- Codex docs: Cloud environments
- Codex docs: Authentication
- Codex docs: Admin rollout guide
- Alexander Stolle, XING: Rolling Out Codex, Agentic Conf Hamburg talk (recorded Mar 22, 2026)
- Justin Boitano, NVIDIA Blog: NVIDIA puts GPT-5.5 Codex to work (published Apr 23, 2026)