The call
Pilot Codex on Business, at US$25 a user a month or US$20 billed annually, with a fixed group and fixed repositories.
Name an owner for each control area, and record a baseline of accepted changes and review time. Expand only when accepted work rises faster than review time and spend.
Engineers who run Codex on personal Plus or Pro plans work outside your SSO and data defaults, so the rollout starts by moving them into a ChatGPT Business or Enterprise workspace. OpenAI's admin rollout guide splits the controls into five areas, and each needs an owner before the first pilot user signs in. This checklist covers the plan, the owners, the pilot measures, and the evidence for expanding.
When you need this
- Engineers already use Codex on personal Plus or Pro plans with company code.
- You are moving from a handful of users to a team, or from a team to the organization.
- Finance wants a cost per engineer once cloud tasks and automatic reviews are on.
- Security asks who can run Codex Cloud, and against which repositories.
Worked example: a 20-engineer pilot budget and gate
Seats
On Business billed annually each seat costs US$20, so the whole group costs US$400 a month (GILD calculation from OpenAI's pricing).
Owners
One person each owns workspace access, local runtime policy, Codex Cloud, connected systems, and reporting and compliance.
How XING did it
XING ran a pull-based rollout, where teams asked for access, and managed Codex defaults centrally on every laptop.
The gate
After six weeks, compare accepted changes, review time per pull request, and post-merge defects with the baseline. Check usage against the 15 to 160 local messages per five hours that OpenAI estimates for Business on GPT-6.1 Sol.
Evaluation criteria
Choose the plan and sign-in route
Which plan does each group get, and how does each person sign in?
Look forBusiness costs US$25 per user per month billed monthly, or US$20 billed annually for 2 or more users. Premium seats cost US$125, or US$100 billed annually, for five times the usage and no five-hour limit. It includes SAML SSO and MFA, and OpenAI does not train on business data by default. Enterprise adds SCIM, EKM, RBAC, Compliance API audit logs, and retention and residency controls. Codex Cloud requires ChatGPT sign-in. Keep API keys for CI, billed at API rates.
Name an owner for every boundary
Who owns each control before the first pilot user signs in?
Look forOpenAI's rollout guide splits ownership into workspace access, local runtime policy, Codex Cloud, connected systems, and reporting and compliance. Give each area a named person and a written record of its effective settings.
Run a bounded pilot
What will you compare when the pilot ends?
Look forKeep the pilot group and repositories fixed, and record a baseline before Codex arrives. Compare accepted changes, review time per pull request, post-merge defects, and usage against plan limits. Measure review time from the first week, because agent output queues at review.
Watch usage and spend
Where do adoption, spend, and audit records each come from?
Look forCodex analytics in Workspace analytics shows adoption, and the Analytics API loads aggregated reporting into your BI system. Audit records come from the Compliance API. Local messages and cloud tasks share each seat's limits. Fast mode draws included limits at 2.5x and Ultrafast at 8x. Enterprise with flexible pricing has no fixed rate limits and scales with credits. OpenAI's pricing page says "Weekly limits may also apply." and gives no figure, so get your workspace's weekly cap from your OpenAI account team before the pilot. XING's engineers hit Codex limits sooner than on their previous tool, and one Plus user reported a single find-and-replace task using the five-hour allowance in about 24 minutes.
Expand on evidence
What has to be true before the next group gets access?
Look forAfter the first rollout, OpenAI's guide calls for reviewing access, connected capabilities, credit use, support feedback, and the workflows teams actually use. Open the next group when accepted, reviewed work rises faster than review time and spend, and let teams ask for access, as XING did.
Questions to ask vendors
- Does our agreement bill Codex on the credit-based rate card, the Enterprise USD rate card, or the legacy rate card?
- Is Codex Cloud on for our Enterprise workspace, and who holds Use Codex in the cloud and Manage workspace environments?
- Which Codex analytics fields are stable enough to report on? OpenAI advises against building a durable contract from dashboard labels.
- How do Fast and Ultrafast modes draw on our credits, and can we restrict them by group?
Red flags
- Company repositories worked on from personal Plus or Pro plans, outside the workspace's SSO and data defaults.
- Pilot success measured by messages sent or lines generated.
- Reporting built on dashboard labels or downloaded report fields.
- No owner for replacing retiring models in workspace defaults, managed configuration, saved settings, and scripts.
Products in this piece
Sources
- Official documentation
- 6
- Public source
- 2
- Codex docs: Pricing
- Codex docs: Authentication
- Codex docs: Admin rollout guide
- Codex docs: Governance
- Codex docs: Models
- OpenAI API pricing
- Alexander Stolle, XING: Rolling Out Codex, Agentic Conf Hamburg talk (recorded Mar 22, 2026)
- Jessica Doering: The Codex 5-Hour Limit Is Making It Practically Unusable (published Aug 30, 2026)