Codex CLI Sandbox & Approval Modes: suggest vs auto-edit vs full-auto

The Sandbox System: How Codex Controls AI Permissions

Unlike inline completion tools like GitHub Copilot, Codex CLI is an AI agent that actually executes actions — it can modify files, run shell commands, and install dependencies. This means it needs a permission control layer to prevent the AI from acting beyond its intended scope.

Codex CLI implements this through approval modes, with three levels:

suggest Mode: Safest, Full Human Oversight

This is Codex CLI's default mode. Before every file edit or shell command, Codex displays the proposed change (a diff, or the command text) and waits for you to press y to apply or n to skip.

$ codex
# equivalent to:
$ codex --approval-mode suggest

In suggest mode, the interaction loop is:

1. AI analyzes the task and generates an execution plan
2. For each file change, a unified diff is shown — you choose Apply or Skip
3. For each shell command, the command is shown — you choose Run or Skip
4. You can also choose Edit to manually adjust the AI's suggestion before applying

Best suited for:

• First-time Codex users getting a feel for how the AI behaves
• Production code that needs line-by-line review before committing
• Learning a technology or code style through AI examples
• New projects where you haven't established trust with the AI's output yet

auto-edit Mode: Auto Files, Manual Shell Commands

auto-edit lets the AI automatically apply file changes, but still requires your confirmation before executing shell commands. This is the sweet spot for most experienced developers in day-to-day work.

$ codex --approval-mode auto-edit
# shorthand flag:
$ codex --auto-edit

Why keep shell commands behind a confirmation? File changes are visible and reversible (Git rollback). Shell commands have broader potential impact — think rm -rf, npm publish, system config changes — so the human-in-the-loop guardrail stays for these.

Best suited for:

• Developers who've used Codex enough to trust its output patterns
• Bulk file modification tasks (refactoring, adding type annotations, JSDoc)
• Projects with solid Git history — mistakes can be rolled back

# Files updated automatically; npm run check still needs your OK
$ codex --auto-edit
# then type: add strict TypeScript types to all components in src/

full-auto Mode: Fully Autonomous — For CI/CD

In full-auto mode, Codex completes all operations autonomously — file edits and shell commands alike — with no human confirmation. This is the standard mode for codex exec in CI/CD pipelines.

# Interactive mode (rarely used; be careful)
$ codex --approval-mode full-auto

# codex exec (common — non-interactive, good for scripts and CI)
$ codex exec --approval-mode full-auto "generate CHANGELOG entry"
# or using the shorthand flag:
$ codex exec --dangerously-auto-approve-everything "fix all lint errors"

Best suited for:

• CI/CD pipelines (GitHub Actions, GitLab CI)
• Running in a Docker container or ephemeral environment
• Clear, well-bounded automation tasks (generate changelog, fix specific errors)
• Projects with a full test suite that can validate AI output

Sandbox Boundaries: What Codex Will Never Do

Regardless of approval mode, Codex CLI has built-in safety constraints:

• Won't access system directories outside ~/ unless explicitly instructed
• Won't initiate network connections beyond normal API calls
• Operating scope defaults to the current working directory
• On macOS, uses Apple Sandbox — system-level isolation even in full-auto mode
• Additional restrictions via AGENTS.md disallow_commands

# Block high-risk commands via AGENTS.md
disallow_commands:
  - rm -rf
  - git push --force
  - npm publish
  - pip install  # can be re-enabled in CI

Persistent Approval Mode Configuration

Specifying the approval mode via command-line flags every time gets tedious. Set a persistent default instead:

Global Default (~/.codex/config.toml)

# Change global default to auto-edit (recommended for experienced users)
approval_mode = "auto-edit"

# Options: "suggest" | "auto-edit" | "full-auto"

Project-Level Default (AGENTS.md)

# This project has full CI coverage — auto-edit is fine locally
approval_mode: auto-edit

## Project context...

CI/CD Recommended Setup

name: AI Code Tasks
on:
  push:
    branches: [main]
jobs:
  codex-tasks:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run Codex task
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          npm install -g @openai/codex
          # full-auto is safe in a CI container
          codex exec --approval-mode full-auto "update CHANGELOG.md with latest changes"

Side-by-Side Comparison

Best Practices

Regardless of mode, these habits reduce risk significantly:

• Keep the project under Git version control: every change has a rollback path
• Restrict high-risk commands in AGENTS.md: especially important in full-auto mode
• Use codex exec for full-auto: non-interactive exec is better suited for batch tasks and has natural isolation in CI
• Write precise task descriptions: vague tasks are riskier in full-auto because the scope is undefined

Frequently Asked Questions