Documentation 2026-11-02 23:02 UTC to 2026-11-03 23:57 UTC

43Choose the provider for the Amazon Bedrock endpoint you want to use: Bedrock43Choose the provider for the Amazon Bedrock endpoint you want to use: Bedrock

44Runtime for cross-Region inference (CRIS), or Bedrock Mantle for in-Region inference.44Runtime for cross-Region inference (CRIS), or Bedrock Mantle for in-Region inference.

45 45 

46Use Bedrock Runtime for new configurations:46Use Bedrock Runtime for new configurations. For Daybreak Blue and Daybreak Red,

47follow [Daybreak model setup](#daybreak-blue-and-daybreak-red) to use Mantle.

48 

49For Runtime:

47 50 

48```toml51```toml

49model_provider = "amazon-bedrock-runtime"52model_provider = "amazon-bedrock-runtime"

241GPT-6 Sol and Luna are available through Mantle in `us-east-1` (N. Virginia).244GPT-6 Sol and Luna are available through Mantle in `us-east-1` (N. Virginia).

242Model availability varies by AWS Region. See AWS [Regional availability by models](https://docs.aws.amazon.com/bedrock/latest/userguide/models-region-compatibility.html#model-regions-openai) before selecting a provider and a model. For GPT-6 Astra, refer to the [Bedrock model page for GPT-6 Astra](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-astra.html).245Model availability varies by AWS Region. See AWS [Regional availability by models](https://docs.aws.amazon.com/bedrock/latest/userguide/models-region-compatibility.html#model-regions-openai) before selecting a provider and a model. For GPT-6 Astra, refer to the [Bedrock model page for GPT-6 Astra](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-astra.html).

243 246 

247#### Daybreak Blue and Daybreak Red

248 

249Approved customers can use the following Daybreak models through Mantle in

250`us-east-2` (Ohio):

251 

252- Daybreak Blue: `openai.gpt-daybreak-blue-5.6-sol`

253- Daybreak Red: `openai.gpt-5.6-cyber`

254 

255**Note:** On [OpenAI-hosted services](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview), you can select Daybreak separately from the model.

256On Bedrock, the model IDs above enable Daybreak behavior by default, with no extra

257Daybreak setting.

258 

259These models support in-Region inference through `amazon-bedrock`. They don't

260support Runtime or Geo and Global cross-Region inference. Use the exact model

261IDs above without a `us.` or `global.` prefix. See the AWS model cards for [Daybreak Blue](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-daybreak-blue-56-sol.html) and [Daybreak Red](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-cyber.html).

262 

263Request access through the [enterprise Daybreak application](https://openai.com/form/enterprise-trusted-access-for-cyber/) or your OpenAI account team. After approval,

264work with your AWS account team to provision the model on Amazon Bedrock.

265GPT-5.6-Cyber requires separate model-specific approval beyond Daybreak Red.

266Confirm the [Daybreak access requirements](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview) with your OpenAI account team.

267 

268After provisioning, select Daybreak Blue explicitly in `~/.codex/config.toml`:

269 

270```toml

271model_provider = "amazon-bedrock"

272model = "openai.gpt-daybreak-blue-5.6-sol"

273 

274[model_providers.amazon-bedrock.aws]

275region = "us-east-2"

276```

277 

278For approved Daybreak Red access to GPT-5.6-Cyber, replace the model ID with

279`openai.gpt-5.6-cyber` and keep the same provider and Region. Keep your

280[AWS authentication](#authentication-options) configured, then

281[verify the selected provider and model](#verify-setup).

282 

244## Feature availability283## Feature availability

245 284 

246This configuration supports local ChatGPT Work and Codex workflows. Hosted285This configuration supports local ChatGPT Work and Codex workflows. Hosted

82- destructive actions with significant risk of irreversible damage82- destructive actions with significant risk of irreversible damage

83 83 

84The exact policy lives in the open-source Codex repository:84The exact policy lives in the open-source Codex repository:

85[policy_template.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy_template.md)85[policy_template.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy_template.md)

86and86and

87[policy.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md).87[policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).

88That policy can be customized per enterprise with `guardian_policy_config` or88That policy can be customized per enterprise with `guardian_policy_config` or

89per user with local [`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes).89per user with local [`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes).

90 90 

140[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).140[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).

141 141 

142The default reviewer policy is in the open-source Codex repository:142The default reviewer policy is in the open-source Codex repository:

143[core/src/guardian/policy.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md).143[prompts/templates/guardian/policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).

144Enterprises can replace its tenant-specific section with144Enterprises can replace its tenant-specific section with

145`guardian_policy_config` in managed requirements. Individual users can also set145`guardian_policy_config` in managed requirements. Individual users can also set

146a local146a local

15 15 

16Your dot is an always-on agent that keeps work moving across your tools and projects. You can keep talking to it while it works, and it reaches out with results or decisions that need you.16Your dot is an always-on agent that keeps work moving across your tools and projects. You can keep talking to it while it works, and it reaches out with results or decisions that need you.

17 17 

18Powered by GPT-6 Astra, your dot lives in the cloud and has its own computer and browser. You can reach it and it can keep working even when your computer is off. It can research, analyze data, prepare documents, and build software, using relevant context from past conversations and your preferences.18We’re expanding the family of frontier models that power dots to include GPT-6.1 Terra. Your dot can draw on different models for different parts of its work. GPT-6.1 Terra builds on the GPT-6 series’ alignment improvements and uses safeguards developed for GPT-6 Astra.

19 

20Your dot lives in the cloud and has its own computer and browser. You can reach it and it can keep working even when your computer is off. It can research, analyze data, prepare documents, and build software, using relevant context from past conversations and your preferences.

19 21 

20<a id="access-to-dots"></a>22<a id="access-to-dots"></a>

21 23 

480 480 

481### Configure managed requirements481### Configure managed requirements

482 482 

483Deploy administrator-enforced Windows requirements to:483By default, deploy administrator-enforced Windows requirements to:

484 484 

485```text485```text

486%ProgramData%\OpenAI\Codex\requirements.toml486%ProgramData%\OpenAI\Codex\requirements.toml

487```487```

488 488 

489Override this location by setting the `RequirementsPath` string under `HKLM\SOFTWARE\Policies\OpenAI\Codex` to an absolute file path.

490 

489Deliver the file through your endpoint management tool. Give intended users read access and prevent ordinary users from changing the administrator-owned policy.491Deliver the file through your endpoint management tool. Give intended users read access and prevent ordinary users from changing the administrator-owned policy.

490 492 

491Requirements constrain settings; configuration defaults supply starting values. Review both the local file and applicable cloud policy to determine the effective configuration.493Requirements constrain settings; configuration defaults supply starting values. Review both the local file and applicable cloud policy to determine the effective configuration.

82- destructive actions with significant risk of irreversible damage82- destructive actions with significant risk of irreversible damage

83 83 

84The exact policy lives in the open-source Codex repository:84The exact policy lives in the open-source Codex repository:

85[policy_template.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy_template.md)85[policy_template.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy_template.md)

86and86and

87[policy.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md).87[policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).

88That policy can be customized per enterprise with `guardian_policy_config` or88That policy can be customized per enterprise with `guardian_policy_config` or

89per user with local [`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes).89per user with local [`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes).

90 90 

140[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).140[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).

141 141 

142The default reviewer policy is in the open-source Codex repository:142The default reviewer policy is in the open-source Codex repository:

143[core/src/guardian/policy.md](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md).143[prompts/templates/guardian/policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).

144Enterprises can replace its tenant-specific section with144Enterprises can replace its tenant-specific section with

145`guardian_policy_config` in managed requirements. Individual users can also set145`guardian_policy_config` in managed requirements. Individual users can also set

146a local146a local

483`provenance` from the same saved results. Both fields are `null` when483`provenance` from the same saved results. Both fields are `null` when

484`output: "-"` writes to stdout. Export requires Python 3.10 or later.484`output: "-"` writes to stdout. Export requires Python 3.10 or later.

485 485 

486For ServiceNow Manual AVIT Ingestion, [prepare the application template](https://learn.chatgpt.com/docs/security/cli/reference#export-findings-for-servicenow) and pass its path as `avitTemplate`.486For ServiceNow Manual AVIT Ingestion, set `artifact: "findings"` and

487 487`format: "servicenow-avit"`. [Prepare the application template](https://learn.chatgpt.com/docs/security/cli/reference#export-findings-for-servicenow)

488```ts488and pass its path as `avitTemplate`. Set `output` to the destination CSV path.

489await exportArtifact({

490 source: { directory: "/path/to/scan" },

491 artifact: "findings",

492 format: "servicenow-avit",

493 avitTemplate: "/path/outside/repository/exports/app.csv",

494 output: "/path/outside/repository/exports/findings-avit.csv",

495});

496```

497 489 

498## Validate an existing finding490## Validate an existing finding

499 491