Skip to main content

Decision brief

Codex Review: What to Settle Before Standardizing a Team on Codex

Choose Codex to run one agent policy across a mixed fleet, native Windows included. Expect OpenAI-only models on ChatGPT plans and uneven results on large or ambiguous tasks.

Reading time
4 min read
Sources
19 cited
In this piece
Codex+55 Strong positive

GILD verdict

Choose Codex when one agent policy has to hold across a mixed fleet.

Its sandbox starts on and runs natively on Windows, and Agent Security overrides it per user, group or role. Scope tasks tightly and enforce a review standard before usage grows, because practitioners report uneven results on large or ambiguous tasks and plan limits vary by model. OpenAI lists Business at US$25 per user a month, or US$20 billed annually for two or more users, so 20 engineers cost US$400 to US$500 a month before credits. Premium seats, at US$100 to US$125 for five times the usage, put the same 20 at US$2,000 to US$2,500.

Codex

AI Coding Agent by OpenAI

+55 Strong positive
Product page

Fit and limits

Who it fits

  • Some engineers work on native Windows. The sandbox runs natively in PowerShell, under the same Agent Security policy as every other machine.
  • Engineers want to keep their editor. The extension runs in VS Code, Cursor and Windsurf, and Xcode and JetBrains IDEs have their own Codex integrations.
  • You want to hand tasks to Codex Cloud from the web, mobile, the desktop app, the CLI, GitHub, Slack, or Linear, and review the result later.
  • You want CI automation from the same agent, through codex exec or the Codex GitHub Action with an API key.
  • You want a second reviewer beside another agent. DHH at 37signals ends every Claude Code job with a Codex review at xhigh effort, and Superhuman's code reviewer calls Codex on complex pull requests.

Where it falls short

  • Usage limits depend on model, context and task size. OpenAI publishes ranges in place of fixed counts, such as 15 to 160 local messages per five hours on GPT-6.1 Sol for Plus and Business. It says cloud tasks may use more of the allowance. In mid-October 2026 several users reported weekly allowances dropping suddenly (GitHub issue 54677, opened Oct 16), and one posted an OpenAI email admitting a plan-transition allowance error and adding US$500 in credits. OpenAI has published no incident note, so track remaining limits per seat through the pilot.
  • ChatGPT plans include OpenAI's models only, so teams that want Anthropic or Google models under one plan need another tool.
  • Signing in with an API key removes the cloud features, including Codex Cloud, GitHub code review, and Slack.
  • RBAC, SCIM, the analytics dashboard, Compliance API audit logs, and retention and residency controls require Enterprise, so access by role and an audit trail mean an Enterprise contract. Business has SAML SSO, MFA, and cloud-managed config policies.
  • Long unattended runs need checks and a spend cap. Armin Ronacher's 35-hour run with GPT-6 Astra burned about US$1,200 of tokens and delivered nothing of value in September 2026, and Quesma used US$270 of Business overflow on one pull request within 24 hours in August 2026.

Implementation reality

  1. Decide the sign-in route first

    Signing in with ChatGPT applies workspace permissions, RBAC, and Enterprise retention and residency settings. An API key applies the API organization's retention and data-sharing settings instead and bills at API rates. Codex Cloud and GitHub code review require ChatGPT sign-in, so keep API keys for CI and scripted work.

  2. Set sandbox and approval defaults

    Local clients start in workspace-write mode with network access off, and ask before leaving the workspace or using the network. Agree whether anyone may use full access, then enforce it through requirements.toml, which every plan supports, or cloud-managed policies in Agent Security on Business and Enterprise. From Codex 0.138.0, OpenAI recommends enforcing permission profiles in place of legacy sandbox modes.

  3. Put a ceiling on usage

    Plus, Business, and Enterprise seats without flexible pricing share per-seat limits across local and cloud work, and weekly limits may also apply. Enterprise with flexible pricing has no fixed rate limits and scales with credits. Fast mode draws included limits at 2.5x and Ultrafast at 8x, so review per-user spend limits before enabling them. Reviews Codex runs on GitHub count as Code Review usage, and reviews run locally draw on the general limits.

  4. Scope Codex Cloud

    Codex Cloud is off by default on Enterprise until an admin grants Use Codex in the cloud. Each environment sets its own internet access, from package managers or custom domains to unrestricted, and cloud environments do not inherit local device policy, so review them separately.

  5. Write the rules down

    Codex reads AGENTS.md from the global Codex home and from the project root down to the working directory, up to 32 KiB combined by default. A Code Review Rules section in the same files guides @codex review on GitHub pull requests.

What to verify before you buy

  1. Which sign-in route each use takes: ChatGPT sign-in for people, API keys only for CI, since an API key removes Codex Cloud, GitHub review, and Slack.
  2. That requirements.toml or cloud-managed policies keep local clients in workspace-write mode with network access off unless you decide otherwise.
  3. That Codex Cloud stays off on Enterprise until an admin grants it, and what internet access each cloud environment gets.
  4. How far per-seat limits stretch in a week of real work with cloud tasks included, before anyone turns on Fast or Ultrafast mode.
  5. Whether you need Enterprise for RBAC, SCIM, the analytics dashboard, audit logs, and retention and residency controls.

What to measure in your pilot

  • OpenAI's docs and practitioner posts report local and Codex Cloud results together. For two weeks, tag each merged pull request by where it ran, and shift work to the cloud if rework holds.
  • OpenAI publishes no daily limits for teams running cloud tasks and automatic reviews. Read each engineer's usage dashboard daily for two weeks, and move anyone hitting limits twice weekly to Pro or credits.
  • GILD found no published precision figures for @codex review. For one month, record which of its P0 and P1 flags engineers fix before merge, and keep automatic reviews on repositories where most are fixed.

Sources

Official documentation
18
Public source
1
  1. Codex docs: PricingOfficial documentationlearn.chatgpt.com
  2. ChatGPT Business pricingOfficial documentationopenai.com
  3. OpenAI API pricingOfficial documentationdevelopers.openai.com
  4. Codex docs: ModelsOfficial documentationlearn.chatgpt.com
  5. Codex docs: AuthenticationOfficial documentationlearn.chatgpt.com
  6. Codex docs: Codex CLIOfficial documentationlearn.chatgpt.com
  7. Codex docs: IDE extensionOfficial documentationlearn.chatgpt.com
  8. Codex docs: CloudOfficial documentationlearn.chatgpt.com
  9. Codex docs: Cloud environmentsOfficial documentationlearn.chatgpt.com
  10. Codex docs: Agent approvals & securityOfficial documentationlearn.chatgpt.com
  11. Codex docs: SandboxingOfficial documentationlearn.chatgpt.com
  12. Codex docs: AGENTS.mdOfficial documentationlearn.chatgpt.com
  13. Codex docs: GitHub code reviewOfficial documentationlearn.chatgpt.com
  14. Codex docs: Use Codex in LinearOfficial documentationlearn.chatgpt.com
  15. Codex docs: Admin rollout guideOfficial documentationlearn.chatgpt.com
  16. Codex docs: Managed configurationOfficial documentationlearn.chatgpt.com
  17. Codex docs: Non-interactive modeOfficial documentationlearn.chatgpt.com
  18. Codex docs: Codex GitHub ActionOfficial documentationlearn.chatgpt.com
  19. Terminal-Bench 4.0 leaderboard (Oct 23, 2026)Public sourcetbench.ai

Keep reading

  1. Buyer guideAmp Team Rollout and Spend ChecklistWhat to settle before engineers move from personal Amp accounts to a shared workspace, and how to grade the pilot when it ends.
  2. Buyer guideCodeRabbit in Your Coding Agents' LoopHow to wire the CodeRabbit CLI into Claude Code, Codex, Cursor, or Gemini, for teams whose agents open pull requests faster than reviewers read them.
  3. Buyer guideCodex Workflow Playbook: From AGENTS.md to a Verified MergeBrief Codex before work, size the model to the task, and check its diff before it reaches the main branch.
Read the research