How to enable auto mode in Codex: /permissions and approval settings

How to enable auto mode in Codex: run /permissions in the CLI and pick the mode you want, or start Codex with --sandbox workspace-write --ask-for-approval on-request. OpenAI's security documentation calls that combination the Auto preset. Codex does not have one switch called "auto mode", and the docs use different names for related settings, so this guide covers each one.

We read OpenAI's Codex documentation for this guide and did not run the commands ourselves. The docs live at developers.openai.com/codex, which now redirects to learn.chatgpt.com/docs.

What Auto means in Codex

Codex splits permissions into two parts. The sandbox decides which files and network resources Codex can reach. Approvals decide when Codex stops to ask you first. OpenAI's docs name three presets:

In Auto, Codex can edit files and run commands in the workspace without asking. It asks before it goes outside the sandbox, for example to edit files outside the workspace or to use the network. Network access is off by default in workspace-write. The workspace is the current directory plus temporary directories such as /tmp. Run /status to see exactly which directories are included.

Codex may also start in read-only until you trust the working directory.

How to switch modes with /permissions

1. Open Codex in your project folder.
2. Enter /permissions. The CLI describes it as the command to "choose what Codex is allowed to do".
3. Select the mode you want. The control also lets you check the active sandbox and writable roots before you continue.
4. Check that the mode you picked is the one selected for the current chat. An available mode is not always the active one.

In the ChatGPT desktop app and the IDE extension, the same choice sits in the permissions control below the composer.

Which modes you see depends on your app version, where Codex runs, your local configuration and your organization's requirements. A mode can be disabled or missing, and managed requirements can restrict it.

How to start Codex in Auto from the command line

Set the sandbox and the approval policy as flags:

codex --sandbox workspace-write --ask-for-approval on-request

-a is the short form of --ask-for-approval. For a non-interactive run, use codex exec --sandbox workspace-write.

How to set Auto in config.toml

The two keys are sandbox_mode and approval_policy:

sandbox_mode = "workspace-write"
approval_policy = "on-request"

To let commands reach the network inside the workspace sandbox, add:

[sandbox_workspace_write]
network_access = true

How to turn on "Approve for me" (auto-review)

Some of OpenAI's pages use "auto" for a different feature. The permission modes page lists "Approve for me", which sends eligible approval requests to an automatic reviewer. It keeps the same workspace boundary as "Ask for approval". Changing the reviewer does not widen the sandbox.

• In the desktop app, choose Approve for me from the permissions control below the composer.
• In the CLI or local config, set approvals_reviewer to auto_review and use an interactive approval policy such as on-request. Changing the approval policy alone does not turn the reviewer on.

approval_policy = "on-request"
approvals_reviewer = "auto_review"

You can add rules for the reviewer in an [auto_review] table. extra_policy adds rules to the active policy, and policy replaces it, so include every rule you want to keep. Administrators can require auto-review through managed configuration.

If a command is denied, /approve in the open-source terminal interface opens the Auto-review Denials picker. You can approve one recent denial for a single retry. The approval covers only that exact action, and the retry is still reviewed.

For most models, the CLI interrupts the turn after 3 consecutive denials or 10 denials in the last 50 reviews. For models designated for cybersecurity work, the first denial interrupts the turn.

OpenAI says auto-review is not a deterministic security guarantee. Keep an enforceable sandbox, and avoid approval_policy = "never", :danger-full-access and --yolo if you want review to apply. Reviewer transcripts are stored under ~/.codex/sessions by default.

How to enable full access

Full access is danger-full-access with no approvals, and OpenAI does not recommend it. The command-line form is:

codex --dangerously-bypass-approvals-and-sandbox

The short alias is --yolo. It removes both the sandbox and the approval prompts. OpenAI also warns that inside Dev Containers, full-access modes let a malicious project reach anything in the container, including Codex credentials.

Is there a plan mode in Codex?

The pages we read describe no separate plan mode. To chat or plan without Codex changing anything, the docs say to use /permissions to switch to read-only.

Common problems

• The mode is missing or greyed out. Your app version, environment or organization requirements can disable it. OpenAI's permission modes page has a troubleshooting section for a missing Approve for me option.
• Codex fails to start after you edit config. The untrusted approval policy is retired. Remove it from configuration files, profiles, startup scripts and managed defaults.
• The sandbox does not work in Docker. Containers can block the namespaces the Linux sandbox needs. The docs recommend running with full access inside a container that provides the isolation.
• A path stays read-only. Some paths in writable roots stay read-only, including .git, .agents, .codex and .aws.
• Commands cannot reach the network. workspace-write blocks it by default. Set network_access = true as shown above.

To see how a command behaves under the sandbox, run codex sandbox macos, codex sandbox linux or codex sandbox windows. For the same setting in a rival tool, see our guide to Claude Code auto mode.