Summary: OpenAI runs Codex on one plain idea: the agent stays productive inside a bounded environment, everyday low-risk actions cost zero friction, and anything riskier stops for review. The developer docs walk through configuring these controls, and enterprise and Edu customers also get access to the Compliance API. OpenAI leans on identity management it already had (the ChatGPT enterprise workspace), compliance logging platforms, and the reach to push managed configurations onto every device.
Once coding agents are left to review repositories, execute commands, and drive developer tools by themselves, the question security teams ask changes shape: “what did the agent do?” matters less than “why did it do that?” In a post published in May 2026, “Running Codex safely at OpenAI,” OpenAI describes how it runs Codex, its AI coding agent, internally without letting the agent run loose. Rather than locking everything down, the framework draws clear boundaries, waves low-risk actions through, and holds anything consequential up for review. Teams weighing an AI agent rollout should note the underlying message: control exists not to slow developers down but to make the safe option the convenient one.
Ground Rule: Stay Productive Within Set Boundaries
OpenAI runs Codex on one plain idea: the agent stays productive inside a bounded environment, everyday low-risk actions cost zero friction, and anything riskier stops for review. Two complementary mechanisms carry this out—sandboxing and approvals.
The sandbox draws the technical execution boundary: which locations Codex may write files to, whether it can reach the network, and which paths sit under protection. Approval policy handles the other half, deciding when Codex has to come back and ask the user—for instance, whenever a planned step falls outside the sandbox. Asked for permission, a user can either green-light one action or clear that whole type of action for the remainder of the session.
Interruptions get trimmed by a feature OpenAI calls Auto-review mode. The moment a request crosses the sandbox boundary, Codex hands the planned action, together with recent context, to an auto-approval subagent. That subagent can clear low-risk actions on its own—and high-risk ones too, provided the user’s authorization is sufficient—rather than pinging the user each time. Routine work therefore keeps flowing, while genuinely risky operations still stop and wait for a person.
Network, Identity, and Rules: Defense in Layers
Outbound, Codex gets nothing close to unrestricted network access. A managed network policy admits only expected destinations, keeps Codex away from sites OpenAI would rather it never touch, and sends unfamiliar domains to approval first. Common, known-good workflows still finish without a hitch, while internet-facing exposure stays small.
Identity and credentials get the same hard line. OAuth credentials for the CLI and MCP live in the secure OS keyring, signing in has to happen through ChatGPT, and access is pinned to the company’s ChatGPT enterprise workspace. Every piece of Codex activity lands in the ChatGPT Compliance Logs Platform for enterprise workspaces, so an audit trail always exists.
Rules carry plenty of weight too: OpenAI grades shell commands by risk. Benign commands that daily development leans on run outside the sandbox without any approval, whereas specific dangerous ones get blocked or flagged for review. Enforcement comes from three places working together—cloud-managed requirements, macOS managed preferences, and local requirements files. Individual users cannot override the rules, though teams may tune them per group or environment.
Agent-Native Telemetry: Capturing “Why,” Not Just “What”
Conventional security logs stop at “what happened”—a process started here, a file changed there, a network connection got attempted. What security teams actually need is “why Codex did something,” plus a read on the user’s intent behind it. That gap is what agent-native telemetry closes.
Through OpenTelemetry log export, Codex captures events such as user prompts, tool approval decisions, tool execution results, MCP server usage, and network proxy allow/deny events. All of it can be funneled into a SIEM or compliance logging system.
Inside OpenAI, an AI-powered security triage agent works off these logs. If an endpoint alert flags unusual Codex behavior, the triage agent pulls the Codex logs and walks through the original request, tool activity, approval decisions, tool results, and any network policy decisions. Its analysis then goes to the security team, who sort out whether the event was expected behavior, a benign mistake, or a genuine escalation.
Operationally, the same telemetry does double duty: it shows how adoption is trending, which tools and MCP servers see use, how often the network sandbox blocks or prompts, and where the rollout could use tuning.
Where Your Team Should Start
OpenAI’s experience makes one thing plain: no single tool secures a coding agent deployment. It takes control surfaces, configuration management, sandboxing, and telemetry working as a set. A concrete place to begin:
- Set execution boundaries up front. Spell out what the agent may and may not do, then keep low-risk actions frictionless so developers never fight the controls.
- Grade command risk with rules. A blanket block and a blanket allow both fail; write a policy that lets common benign commands through while blocking or reviewing the dangerous ones.
- Make logs explain “why,” not merely “what.” Agent-native telemetry—capturing prompts, decisions, and outcomes—is what auditing and incident response actually depend on.
Already on Codex? The developer docs walk through configuring these controls, and enterprise and Edu customers also get access to the Compliance API.
Caveats and Costs
A framework like this presumes a base level of enterprise infrastructure. OpenAI leans on identity management it already had (the ChatGPT enterprise workspace), compliance logging platforms, and the reach to push managed configurations onto every device. Organizations missing those foundations will probably need to build them before an agent ships.
Upkeep matters just as much: rules and network policies stay useful only while someone maintains them, and each new tool or workflow forces another round of tuning. Auto-review cuts friction, but it also means trusting the subagent’s judgment—a risk that itself calls for monitoring.
What to Carry Away
Treat OpenAI’s Codex deployment as a blueprint for bringing AI agents on board safely. The trick is to stop short of restricting agents into uselessness and instead build an environment where they stay productive inside clear boundaries, risk passes through approval, and logs explain the behavior. Product builders and AI tool learners can compress the lesson into three moves: draw boundaries first, classify the risk, and put real investment into telemetry that answers “why.” That combination is what lets you hand agents real work with confidence.