When coding agents start reviewing repositories, running commands, and poking at developer tools on their own, security teams face a new question: not just “what did the agent do?” but “why did it do that?” OpenAI’s May 2026 post, “Running Codex safely at OpenAI,” lays out the internal framework they use to deploy Codex—their AI coding agent—without giving it free rein. The approach is less about locking everything down and more about defining clear boundaries, letting low-risk actions flow, and forcing review on anything that matters. For any team planning to adopt AI agents, the key takeaway is that control isn’t about slowing developers down; it’s about making the safe path the easy path.
The Core Principle: Productive Inside a Bounded Environment
OpenAI’s deployment philosophy is simple: Codex should be productive inside a bounded environment, low-risk everyday actions should be frictionless, and higher-risk actions should stop for review. This is implemented through two complementary mechanisms: sandboxing and approvals.
The sandbox defines the technical execution boundary—where Codex can write files, whether it can reach the network, and which paths are protected. Approval policy, on the other hand, determines when Codex must ask the user for permission, such as when it needs to do something outside the sandbox. Users can approve a single action or approve that type of action for the rest of the session.
To reduce interruptions, OpenAI uses a feature called Auto-review mode. When a request crosses the sandbox boundary, Codex sends the planned action and recent context to an auto-approval subagent. This subagent can automatically approve low-risk actions—or high-risk actions if the user has given sufficient authorization—instead of pinging the user every time. The result: routine work keeps moving, but genuinely risky actions still pause for a human.
Network, Identity, and Rules: Layered Defenses
OpenAI doesn’t give Codex open-ended outbound network access. Their managed network policy allows expected destinations, blocks sites they don’t want Codex touching, and requires approval for unfamiliar domains. This lets Codex complete common, known-good workflows without exposing the whole internet.
Identity and credential management is equally strict. CLI and MCP OAuth credentials are stored in the secure OS keyring, login is forced through ChatGPT, and access is pinned to their ChatGPT enterprise workspace. All Codex activity flows into the ChatGPT Compliance Logs Platform for enterprise workspaces, making it auditable.
Rules also play a big role. OpenAI uses rules to differentiate the risk level of shell commands. Common benign commands used in day-to-day development are allowed without approval outside the sandbox, while specific dangerous commands can be blocked or require approval. These rules are enforced through a combination of cloud-managed requirements, macOS managed preferences, and local requirements files. Users can’t override them, but teams can tune them by group or environment.
Agent-Native Telemetry: From “What” to “Why”
Traditional security logs answer “what happened”: a process started, a file changed, a network connection was attempted. But security teams need to know “why Codex did something” and what the user’s intent was. That’s where agent-native telemetry comes in.
Codex supports OpenTelemetry log export for events like user prompts, tool approval decisions, tool execution results, MCP server usage, and network proxy allow/deny events. These logs can be centralized in SIEM or compliance logging systems.
Internally, OpenAI pairs these logs with an AI-powered security triage agent. When an endpoint alert flags unusual Codex behavior, the security agent pulls Codex logs to inspect the original request, tool activity, approval decisions, tool results, and any network policy decisions. It then surfaces an analysis to the security team to distinguish between expected behavior, benign mistakes, and true escalations.
The same telemetry is used operationally: tracking adoption trends, which tools and MCP servers are used, how often the network sandbox blocks or prompts, and where the rollout needs tuning.
Practical Implementation for Your Team
OpenAI’s experience shows that secure deployment of coding agents isn’t a single tool—it’s a combination of control surfaces, configuration management, sandboxing, and telemetry. Here’s a concrete starting point:
- Define clear execution boundaries. Map out what the agent can and cannot do. Make low-risk actions frictionless so developers don’t get annoyed.
- Use rules to classify command risk. Instead of blocking everything or allowing everything, create a policy that allows common benign commands and blocks or reviews dangerous ones.
- Ensure logs answer “why,” not just “what.” Agent-native telemetry that captures prompts, decisions, and outcomes is essential for auditing and incident response.
If you’re using Codex, you can configure these controls via the developer docs, and the Compliance API is available for enterprise and Edu customers.
Limitations and Trade-offs
This framework assumes a certain level of enterprise infrastructure. OpenAI’s approach relies on existing identity management (ChatGPT enterprise workspace), compliance logging platforms, and the ability to enforce managed configurations across devices. If your organization doesn’t have these foundations, you may need to build them first.
Also, the rules and network policies are only as good as their maintenance. They require ongoing tuning as new tools and workflows emerge. And while Auto-review reduces friction, it still requires trust in the subagent’s judgment—a risk that needs monitoring.
The Takeaway
OpenAI’s deployment of Codex is a blueprint for safe AI agent adoption. The key is not to restrict agents to the point of uselessness, but to create an environment where they can be productive within clear boundaries, with approval for risk and logs that explain behavior. For product builders and AI tool learners, the lesson is clear: start with boundaries, classify risk, and invest in telemetry that answers “why.” That’s how you enable agents with confidence.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.