Approvals & sandbox

Before you let a coding agent loose on a repository you care about, you are making two decisions whether you mean to or not: how much it can do without asking you, and how far it can reach. Get them wrong in one direction and you babysit edits that were always safe; wrong in the other and a bad guess can touch files it had no business touching.

The lazy answer is a single trust slider - more autonomous or less. Codex splits it into two independent dials, and getting them straight is the whole of this chapter:

• How much it can do without asking you - the approval policy. Does work inside the fence flow freely while boundary crossings stop for a y/n, or does nothing ever stop?
• How far it can reach - the sandbox. Read-only? Free to write inside the workspace? Or no fence at all, with the whole filesystem and the network in play?

A single slider forces a bad trade. Turn it up enough to stop babysitting mechanical work and you’ve also turned up how far a wrong guess could reach - on one dial, less interruption and more reach are the same knob. Say the repo holds financial records and the network is where exfiltration happens: you want routine edits that never interrupt you, inside a fence the agent cannot leave and a network it cannot open. One dial cannot say that. Two can. The two risks aren’t the same risk, so they don’t get the same dial.

This is the course’s deepest look at control - the principle of what guides execution, enforces boundaries, or allows intervention. The two dials are also where control most visibly shapes cost (every stop is an interruption you pay in attention) and usable capability (a fence that blocks a needed action buys safety at the price of the task). We’ll name those tradeoffs where they show up rather than pretend one setting is free.

What this chapter covers

The lessons build one model, then make it persistent:

• The two-axis model - why approval and sandbox are separate axes, and how to count what a pairing costs you in interruptions.
• The three sandbox levels - read-only, workspace-write, danger-full-access, and what actually enforces the wall on each operating system.
• The approval policies - on-request and never (plus the granular config form), and the one value that was retired.
• Network and writable directories - network is off by default under workspace-write; how to widen the fence by exactly one capability at a time.
• Profiles - bundle a whole trust posture into a named config file and summon it with one flag, and the one bypass flag to treat as a warning sign.

Where a concrete repo helps, the lessons use one running example: budgetcli, a small self-hosted personal-finance API - 166 lines of Python and about 230 lines including tests, config, rules, and README, with a pytest suite and an AGENTS.md at the root. It stands for any repo where the data matters; each lesson restates the facts it needs, so you can also start from any page.

Start with the model everything else hangs off - the two axes, and why they’re separate.