OpenAI publishes its own Codex guardrails: sandbox, approval subagent, agent-native telemetry
OpenAI detailed how it runs its coding agent internally: Codex operates inside a sandbox that defines writable paths and network reach, with an approval policy that stops higher-risk actions crossing that boundary.
Routine escalations go through Auto-review mode, where an auto-approval subagent receives the planned action plus recent context and approves low-risk requests without interrupting the developer. Network access is a managed allowlist with approval required for unfamiliar domains, and OpenAI keeps agent-native telemetry and audit trails so agent activity can be reviewed after the fact.
WHY IT MATTERS
A rare primary-source look at the sandbox, approval and telemetry split from the team shipping one of the two biggest coding agents — useful as a template for anyone running agents against real repos.
