# How to enable auto mode in Codex: /permissions and approval settings

> Codex's Auto preset is workspace-write with on-request approvals. Here is how to set it from /permissions, the command line or config.toml, plus auto-review and full access.

URL: https://claudegpt.si/news/how-to-enable-auto-mode-in-codex  
Published: 2026-11-06T18:58:19.958Z  
Author: ClaudeGPT Si Newsroom  
Section: Guides  
Topics: OpenAI, Codex, Codex CLI, Permissions  
Publisher: ClaudeGPT Si

## Key takeaways

- OpenAI's Auto preset in Codex is the workspace-write sandbox with the on-request approval policy.
- In the CLI, enter /permissions to switch modes, or start with --sandbox workspace-write --ask-for-approval on-request.
- Approve for me sends approval requests to an automatic reviewer through approvals_reviewer = "auto_review" and does not widen the sandbox.

How to enable auto mode in Codex: run `/permissions` in the CLI and pick the mode you want, or start Codex with `--sandbox workspace-write --ask-for-approval on-request`. OpenAI's [security documentation](https://learn.chatgpt.com/docs/agent-approvals-security) calls that combination the Auto preset. Codex does not have one switch called "auto mode", and the docs use different names for related settings, so this guide covers each one.

We read OpenAI's Codex documentation for this guide and did not run the commands ourselves. The docs live at developers.openai.com/codex, which now redirects to learn.chatgpt.com/docs.

## What Auto means in Codex

Codex splits permissions into two parts. The sandbox decides which files and network resources Codex can reach. Approvals decide when Codex stops to ask you first. OpenAI's docs name three presets:

| Preset | Sandbox mode | Approval policy | When to use it |
| --- | --- | --- | --- |
| Auto | `workspace-write` | `on-request` | The recommended default for version-controlled folders |
| Read-only | `read-only` | `on-request` | Folders that are not version-controlled, or chatting and planning without changes |
| Full access | `danger-full-access` | none | Not recommended |

In Auto, Codex can edit files and run commands in the workspace without asking. It asks before it goes outside the sandbox, for example to edit files outside the workspace or to use the network. Network access is off by default in `workspace-write`. The workspace is the current directory plus temporary directories such as `/tmp`. Run `/status` to see exactly which directories are included.

Codex may also start in read-only until you trust the working directory.

## How to switch modes with /permissions

1. Open Codex in your project folder.
2. Enter `/permissions`. The CLI describes it as the command to "choose what Codex is allowed to do".
3. Select the mode you want. The control also lets you check the active sandbox and writable roots before you continue.
4. Check that the mode you picked is the one selected for the current chat. An available mode is not always the active one.

In the ChatGPT desktop app and the IDE extension, the same choice sits in the permissions control below the composer.

Which modes you see depends on your app version, where Codex runs, your local configuration and your organization's requirements. A mode can be disabled or missing, and managed requirements can restrict it.

## How to start Codex in Auto from the command line

Set the sandbox and the approval policy as flags:

```bash
codex --sandbox workspace-write --ask-for-approval on-request
```

`-a` is the short form of `--ask-for-approval`. For a non-interactive run, use `codex exec --sandbox workspace-write`.

## How to set Auto in config.toml

The two keys are `sandbox_mode` and `approval_policy`:

```toml
sandbox_mode = "workspace-write"
approval_policy = "on-request"
```

To let commands reach the network inside the workspace sandbox, add:

```toml
[sandbox_workspace_write]
network_access = true
```

## How to turn on "Approve for me" (auto-review)

Some of OpenAI's pages use "auto" for a different feature. The permission modes page lists "Approve for me", which sends eligible approval requests to an automatic reviewer. It keeps the same workspace boundary as "Ask for approval". Changing the reviewer does not widen the sandbox.

- In the desktop app, choose Approve for me from the permissions control below the composer.
- In the CLI or local config, set `approvals_reviewer` to `auto_review` and use an interactive approval policy such as `on-request`. Changing the approval policy alone does not turn the reviewer on.

```toml
approval_policy = "on-request"
approvals_reviewer = "auto_review"
```

You can add rules for the reviewer in an `[auto_review]` table. `extra_policy` adds rules to the active policy, and `policy` replaces it, so include every rule you want to keep. Administrators can require auto-review through managed configuration.

If a command is denied, `/approve` in the open-source terminal interface opens the Auto-review Denials picker. You can approve one recent denial for a single retry. The approval covers only that exact action, and the retry is still reviewed.

For most models, the CLI interrupts the turn after 3 consecutive denials or 10 denials in the last 50 reviews. For models designated for cybersecurity work, the first denial interrupts the turn.

OpenAI says auto-review is not a deterministic security guarantee. Keep an enforceable sandbox, and avoid `approval_policy = "never"`, `:danger-full-access` and `--yolo` if you want review to apply. Reviewer transcripts are stored under `~/.codex/sessions` by default.

## How to enable full access

Full access is `danger-full-access` with no approvals, and OpenAI does not recommend it. The command-line form is:

```bash
codex --dangerously-bypass-approvals-and-sandbox
```

The short alias is `--yolo`. It removes both the sandbox and the approval prompts. OpenAI also warns that inside Dev Containers, full-access modes let a malicious project reach anything in the container, including Codex credentials.

## Is there a plan mode in Codex?

The pages we read describe no separate plan mode. To chat or plan without Codex changing anything, the docs say to use `/permissions` to switch to `read-only`.

## Common problems

- **The mode is missing or greyed out.** Your app version, environment or organization requirements can disable it. OpenAI's permission modes page has a troubleshooting section for a missing Approve for me option.
- **Codex fails to start after you edit config.** The `untrusted` approval policy is retired. Remove it from configuration files, profiles, startup scripts and managed defaults.
- **The sandbox does not work in Docker.** Containers can block the namespaces the Linux sandbox needs. The docs recommend running with full access inside a container that provides the isolation.
- **A path stays read-only.** Some paths in writable roots stay read-only, including `.git`, `.agents`, `.codex` and `.aws`.
- **Commands cannot reach the network.** `workspace-write` blocks it by default. Set `network_access = true` as shown above.

To see how a command behaves under the sandbox, run `codex sandbox macos`, `codex sandbox linux` or `codex sandbox windows`. For the same setting in a rival tool, see our guide to [Claude Code auto mode](https://claudegpt.si/news/claude-code-auto-mode-turn-on).

## Frequently asked questions

### What is Auto mode in Codex?

Auto is a preset that combines the workspace-write sandbox with the on-request approval policy. Codex edits files and runs commands in the workspace and asks before going outside it. OpenAI recommends it for version-controlled folders.

### How do I switch Codex modes?

Enter /permissions in the CLI, or use the permissions control below the composer in the desktop app and IDE extension. Check that the mode you picked is the one active for the current chat.

### What does Codex --yolo do?

It is an alias for --dangerously-bypass-approvals-and-sandbox. It disables both the sandbox and approval prompts, and OpenAI does not recommend it.

### Does Codex have a plan mode?

The documentation pages we read describe no separate plan mode. To plan without changes, the docs say to switch to read-only with /permissions.

## Sources

- [Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security), OpenAI
- [Permission modes](https://learn.chatgpt.com/docs/permission-modes), OpenAI
- [Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review), OpenAI
- [Codex CLI](https://learn.chatgpt.com/docs/codex/cli), OpenAI