Documentation 2026-11-05 23:03 UTC to 2026-11-06 23:02 UTC

315approvals_reviewer = "user"315approvals_reviewer = "user"

316```316```

317 317 

318Automatic approval reviews apply when approvals are interactive, such as318Auto-review applies when approvals are interactive, such as

319`approval_policy = "on-request"` or a granular approval policy. Set319`approval_policy = "on-request"` or a granular approval policy. Set

320`approvals_reviewer = "auto_review"` to route eligible approval requests320`approvals_reviewer = "auto_review"` to route eligible approval requests

321through a reviewer agent before Codex runs the request:321through a reviewer agent before Codex runs the action.

322 322 

323```toml323```toml

324approval_policy = "on-request"324approval_policy = "on-request"

330[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review).330[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review).

331 331 

332The reviewer evaluates only actions that already need approval, such as sandbox332The reviewer evaluates only actions that already need approval, such as sandbox

333escalations, blocked network requests, `request_permissions` prompts, or333escalations, network requests that require approval, `request_permissions`

334side-effecting app and MCP tool calls. Actions that stay inside the sandbox334prompts, or app and MCP tool calls that need approval. A command rule can

335continue without an extra review step.335also require review inside the sandbox.

336 336 

337The reviewer policy checks for data exfiltration, credential probing, persistent337The reviewer policy checks for data exfiltration, credential probing, persistent

338security weakening, and destructive actions. Low-risk and medium-risk actions338security weakening, and destructive actions. Low-risk and medium-risk actions

341Prompt-build, review-session, and parse failures fail closed. Timeouts are341Prompt-build, review-session, and parse failures fail closed. Timeouts are

342surfaced separately, but the action still does not run.342surfaced separately, but the action still does not run.

343 343 

344The [default reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md)344To add rules or replace the policy locally or across an organization, see

345is in the open-source Codex repository. Enterprises can replace its345[Auto-review configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).

346tenant-specific section with `guardian_policy_config` in managed requirements.

347Local `[auto_review].policy` text is also supported, but managed requirements

348take precedence. For setup details, see

349[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).

350 346 

351In the ChatGPT desktop app, these reviews appear as automatic review items with a status347In the ChatGPT desktop app, these reviews appear as Auto-review items with a status

352such as Reviewing, Approved, Denied, Aborted, or Timed out. They can also348such as Reviewing, Approved, Denied, Aborted, or Timed out. They can also

353include a risk level and user-authorization assessment for the reviewed349include a risk level and user-authorization assessment for the reviewed

354request.350request.

355 351 

356Automatic review uses extra model calls, so it can add to Codex usage. Admins352Auto-review uses extra model calls, so it can add to Codex usage. Admins

357can constrain it with `allowed_approvals_reviewers`.353can constrain it with `allowed_approvals_reviewers`.

358 354 

359### Common sandbox and approval combinations355### Common sandbox and approval combinations

36 36 

37### A Work conversation does not appear on another device37### A Work conversation does not appear on another device

38 38 

39- Confirm that you are signed in with ChatGPT to the same account and workspace on each device.39- Sign in with ChatGPT to the same account and workspace on each device, and look

40- Ask your workspace owner to check that Work Cloud and **Allow local computer access** are enabled. If `enforce_residency` is enabled in any cloud policy, **Allow local computer access** is disabled for both Work and dots. This safeguard does not configure workspace residency or, by itself, disable Work Cloud or dots.40 in Work history. Codex has a separate history.

41- Check when the task was created. Sync applies to new tasks created after it is enabled. Existing tasks, including tasks in projects, are not migrated and keep their original local-only or cloud-without-local-files behavior.41- Ask your workspace owner to verify Work Cloud and **Allow local computer

42 42 access** in [workspace permissions](https://learn.chatgpt.com/docs/enterprise/cloud-local-access#how-to-set-up-local-computer-access). A cloud policy with

43For enterprises, the in-app Local/Cloud toggle and its default remain unchanged at launch. A particular toggle or default mode does not by itself confirm whether a conversation can sync. Keep Codex history separate when looking for a Work conversation. See [Local computer access for Work Cloud and dots](https://learn.chatgpt.com/docs/enterprise/cloud-local-access) for setup and the [Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) for common questions.43 `enforce_residency` blocks local computer access.

44- If the task predates local computer access, select **Cloud** in the desktop

45 composer and [start a new Work task](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices).

44 46 

45### A synced task cannot use the computer's files or tools47### A synced task cannot use the computer's files or tools

46 48 

47Keep the computer online and connected. If it's unavailable when a new turn starts, an eligible synced task can continue in a cloud container without access to the computer's files or tools. A running turn doesn't automatically move from the computer to the cloud.49Open the ChatGPT desktop app on the computer that holds the files, sign in to

50the same workspace, and keep it online and connected. If you started a turn

51while the computer was offline, it may be running in a cloud container without

52access to those files.

48 53 

49<a id="a-turn-stopped-after-local-computer-access-was-turned-off"></a>54<a id="a-turn-stopped-after-local-computer-access-was-turned-off"></a>

50 55 

51### A turn stopped after Local computer access with Work Cloud was turned off56### A turn stopped after Local computer access with Work Cloud was turned off

52 57 

53Turning off Local computer access with Work Cloud interrupts running turns. If you still have Work access, send a new message to start another turn. In an existing cloud conversation, that turn automatically uses Work Cloud without access to local files.58If you still have Work access, send a new message in the existing cloud

59conversation. The new turn can use Work Cloud, but it cannot use local files.

54 60 

55### Automated policy updates are missing61### Automated policy updates are missing

56 62 

94 94 

95## Agent Security command-network requirements95## Agent Security command-network requirements

96 96 

97On supported managed Codex Cloud execution paths, Agent Security requirements constrain command networking. Codex Cloud environment internet settings apply separately. An allowed domain in Agent Security does not override a restriction in the Cloud environment's internet settings. These command-network controls do not, by themselves, disable hosted web search, apps, or MCP. ChatGPT Work Cloud has separate capability permissions and does not inherit these Agent Security requirements.97If your workspace manages command networking through Agent Security, check the environment's internet settings as well as the managed policy. See [Network isolation](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation) for how the controls apply to commands.

98 

99A managed command allowlist applies to commands using the managed proxy. Where policy permits full sandbox escalation and it is approved, that execution can bypass the command proxy. A narrow network grant is different from full sandbox escalation. Configure enforced approval and sandbox requirements for the intended boundary, and test both ordinary and escalated commands. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-network-access-requirements) for inheritance and proxy limits.

155 155 

156## Agent Security command-network requirements156## Agent Security command-network requirements

157 157 

158On supported managed Codex Cloud execution paths, Agent Security requirements constrain command networking. Codex Cloud environment internet settings apply separately. An allowed domain in Agent Security does not override a restriction in the Cloud environment's internet settings. These command-network controls do not, by themselves, disable hosted web search, apps, or MCP. ChatGPT Work Cloud has separate capability permissions and does not inherit these Agent Security requirements.158When Agent Security also manages command networking, check its policy if the environment allows a destination but a command cannot reach it. For proxy coverage and the effect of an approved full sandbox escalation, see [Network isolation](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).

159 

160A managed command allowlist applies to commands using the managed proxy. Where policy permits full sandbox escalation and it is approved, that execution can bypass the command proxy. A narrow network grant is different from full sandbox escalation. Configure enforced approval and sandbox requirements for the intended boundary, and test both ordinary and escalated commands. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-network-access-requirements) for inheritance and proxy limits.

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Auto-review replaces manual approval at the sandbox boundary with a separate5Auto-review sends eligible approval requests to a separate reviewer agent.

6reviewer agent. The main Codex agent still runs inside the same sandbox, with6Your sandbox, command rules, and tool settings determine which actions need

7the same approval policy and the same network and filesystem limits. The7approval. The reviewer decides whether those actions can proceed.

8difference is who reviews eligible escalation requests.

9 8 

10Auto-review only applies when approvals are interactive. In practice, that9Auto-review only applies when approvals are interactive. In practice, that

11 means `approval_policy = "on-request"` or a granular approval policy that10 means `approval_policy = "on-request"` or a granular approval policy that

25[reviewer-policy configuration](#configuration). The warning doesn't restore24[reviewer-policy configuration](#configuration). The warning doesn't restore

26the sandbox boundary or override organization policy.25the sandbox boundary or override organization policy.

27 26 

28## Select automatic review27 

28 

29 

30## Select Auto-review

29 31 

30In the desktop app, choose **Approve for me** from the permissions control32In the desktop app, choose **Approve for me** from the permissions control

31below the composer. Check that it's selected for the current chat. See33below the composer. Check that it's selected for the current chat. See

34For the CLI or a local Codex configuration, set36For the CLI or a local Codex configuration, set

35`approvals_reviewer = "auto_review"` with an eligible interactive approval37`approvals_reviewer = "auto_review"` with an eligible interactive approval

36policy, such as `approval_policy = "on-request"`. Changing the approval policy38policy, such as `approval_policy = "on-request"`. Changing the approval policy

37alone doesn't select the reviewer. Managed requirements take precedence over39alone doesn't select the reviewer. Administrators can

38local settings; see [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).40[require Auto-review](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-auto-review-policy)

41for their organization.

39 42 

40## How auto-review works43## How Auto-review works

41 44 

42At a high level, the flow is:451. The main agent proposes an action, such as running a command.

43 462. If the action needs approval, Codex creates a request.

441. The main agent works inside `read-only` or `workspace-write`.

452. When it needs to cross the sandbox boundary, it requests approval.

463. If `approvals_reviewer = "auto_review"`, Codex routes that approval request473. If `approvals_reviewer = "auto_review"`, Codex routes that approval request

47 to a separate reviewer agent instead of stopping for a person.48 to a separate reviewer agent instead of stopping for a person.

484. The reviewer decides whether the action should run and returns a rationale.494. The reviewer decides whether the action should run and returns a rationale.

50 agent is instructed to find a materially safer path or stop and ask the51 agent is instructed to find a materially safer path or stop and ask the

51 user.52 user.

52 53 

53Auto-review is a reviewer swap, not a permission grant. It does not expand

54`writable_roots`, enable network access, or weaken protected paths. It only

55changes how Codex handles actions that already need approval.

56 

57## When it triggers54## When it triggers

58 55 

59Auto-review evaluates approval requests that would otherwise pause for a human.56Auto-review evaluates approval requests that would otherwise pause for a human.

60These include:57These include:

61 58 

62- Shell or exec tool calls that request escalated sandbox permissions.59- Shell or exec tool calls that request escalated sandbox permissions.

63- Network requests blocked by the current sandbox or policy.60- Commands that match a [command rule](https://learn.chatgpt.com/docs/agent-configuration/rules) with

61 `decision = "prompt"`, including commands inside the sandbox.

62- Network requests to destinations that require approval. An explicit network

63 deny rule blocks the request.

64- File edits outside the allowed writable roots.64- File edits outside the allowed writable roots.

65- MCP or app tool calls that require approval based on their tool annotations65- MCP or app tool calls that require approval based on their tool annotations

66 or configured approval mode.66 or configured approval mode.

67 67 

68Auto-review does not run for routine actions already allowed inside the68Actions that already have permission to run proceed without review.

69sandbox. If a command can run under the active `sandbox_mode`, or a tool call

70stays within the allowed policy, the main agent continues without review.

71 69 

72Computer Use is a separate case. App approvals for Computer Use still surface70Computer Use app-level access prompts go directly to the user. Eligible

73directly to the user, so Auto-review does not replace those app-level prompts.71Computer Use tool calls can separately trigger Auto-review.

74 72 

75## What auto-review blocks73## What Auto-review blocks

76 74 

77At a high level, Auto-review is designed to block actions such as:75At a high level, Auto-review is designed to block actions such as:

78 76 

81- broad or persistent security weakening79- broad or persistent security weakening

82- destructive actions with significant risk of irreversible damage80- destructive actions with significant risk of irreversible damage

83 81 

84The exact policy lives in the open-source Codex repository:82See [Configuration](#configuration) for the default rules and how to customize them.

85[policy_template.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy_template.md)

86and

87[policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).

88That policy can be customized per enterprise with `guardian_policy_config` or

89per user with local [`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes).

90 83 

91## What the reviewer sees84## What the reviewer sees

92 85 

93The reviewer is itself a Codex agent with a narrower job than the main agent:86The reviewer evaluates the specific action that triggered the approval request.

94decide whether a specific boundary-crossing action should run.

95 87 

96The reviewer sees a compact transcript plus the exact approval request. That88The reviewer sees a compact transcript plus the exact approval request. That

97typically includes user messages, surfaced assistant updates, relevant tool89typically includes user messages, surfaced assistant updates, relevant tool

98calls and tool outputs, and the action now being proposed for approval. It can90calls and tool outputs, and the action now being proposed for approval. It can

99also perform read-only checks to gather missing context, but it does so rarely.91also perform read-only checks, such as inspecting a directory before approving

92its deletion.

100 93 

101Hidden assistant reasoning is not included. Auto-review sees retained94Hidden assistant reasoning is not included. Auto-review sees retained

102chat items and tool evidence, not private chain-of-thought.95chat items and tool evidence, not private chain-of-thought.

111- Continue only with a materially safer alternative.104- Continue only with a materially safer alternative.

112- Otherwise, stop and ask the user.105- Otherwise, stop and ask the user.

113 106 

114Codex also applies a rejection circuit breaker per turn. In the current107For most models, the Codex CLI interrupts the turn after 3 consecutive denials

115open-source implementation, Auto-review interrupts the turn after `3`108or 10 denials in the last 50 reviews in that turn. For models designated for

116consecutive denials or `10` denials within a rolling window of the last `50`109cybersecurity, the CLI interrupts the turn on the first denial.

117reviews in the same turn.

118 110 

119Any non-denial resets the consecutive-denial counter. When the breaker trips,111Any other review outcome resets the consecutive-denial count. When Codex

120Codex emits a warning and aborts the current turn with an interrupt rather than112reaches a denial limit, it displays a warning and stops the turn.

121letting the agent loop on more escalation attempts.

122 113 

123Timeouts are surfaced separately from explicit denials, and the main agent is114Timeouts are surfaced separately from explicit denials, and the main agent is

124informed that a timeout alone is not proof that the action is unsafe.115informed that a timeout alone is not proof that the action is unsafe.

136 127 

137## Configuration128## Configuration

138 129 

139For setup details, see130The [reviewer template](https://github.com/openai/codex/blob/rust-v0.167.0/codex-rs/prompts/templates/guardian/policy_template.md)

140[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).131tells the reviewer how to assess an action. Codex inserts the security policy

132into that template and specifies the response format separately. The CLI uses

133the reviewer model's default policy when available. Otherwise, it uses the

134[bundled policy (`policy.md`)](https://github.com/openai/codex/blob/rust-v0.167.0/codex-rs/prompts/templates/guardian/policy.md).

141 135 

142The default reviewer policy is in the open-source Codex repository:136**To add rules**, set `extra_policy` under `[auto_review]` in local

143[prompts/templates/guardian/policy.md](https://github.com/openai/codex/blob/main/codex-rs/prompts/templates/guardian/policy.md).137`config.toml`, or set the top-level `guardian_extra_policy` in managed

144Enterprises can replace its tenant-specific section with138`requirements.toml`. Codex applies these rules alongside the active policy.

145`guardian_policy_config` in managed requirements. Individual users can also set

146a local

147[`[auto_review].policy`](/codex/config-file/config-advanced#approval-policies-and-sandbox-modes)

148in their `config.toml`, but managed requirements take precedence:

149 139 

150```toml140**To replace the policy**, copy the complete policy you want to adapt. If you

151[auto_review]141use the bundled default, copy the full contents of `policy.md`. Edit the rules

152policy = """142you want to change, then put the full text in local `[auto_review].policy` or

153YOUR POLICY GOES HERE143managed `guardian_policy_config`. Omitted rules drop out of the replacement.

154"""144Codex still uses the reviewer's template and response format.

155```145 

146Codex resolves the two settings independently and ignores blank values.

147Managed `guardian_policy_config` takes precedence over local `[auto_review].policy`.

148Managed `guardian_extra_policy` takes precedence over local `[auto_review].extra_policy`.

149For example, if your organization sets only a replacement policy, your local

150`extra_policy` still adds rules to it.

156 151 

157To customize the policy, copy the whole default policy wording first, then152For organization-wide setup, see

158iterate based on your individual risk profile.153[Configure Auto-review policy](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-auto-review-policy).

159 154 

160## Configure an authorized cybersecurity engagement155## Configure an authorized cybersecurity engagement

161 156 

162For authorized security work, combine automatic review with a written157For authorized security work, combine Auto-review with a written

163engagement scope and a least-privilege [permission profile](https://learn.chatgpt.com/docs/permissions).158engagement scope and a least-privilege [permission profile](https://learn.chatgpt.com/docs/permissions).

164Use an approved lab target, document the actions and engagement window, and159Use an approved lab target, document the actions and engagement window, and

165keep production systems, unrelated hosts, credentials, and persistent changes160keep production systems, unrelated hosts, credentials, and persistent changes

166out of scope unless explicitly authorized.161out of scope unless explicitly authorized.

167 162 

168Both `[auto_review].policy` and `guardian_policy_config` replace your current163This local `config.toml` example enables Auto-review and adds engagement

169reviewer policy. They don't merge with policies bundled with your model or164rules to the active policy. Replace the example target and actions with your

170managed by your organization. The built-in review instructions and response165approved scope.

171format still apply. Before using either example, copy the complete current

172policy, keep every existing rule, and add the rules for your approved work.

173Replace the uppercase placeholder with that complete policy. If you can't

174access the current policy, don't override it.

175 

176The following local `config.toml` template enables review and adds scoped

177conditions after the existing reviewer policy:

178 166 

179```toml167```toml

180approval_policy = "on-request"168approval_policy = "on-request"

182default_permissions = ":workspace"170default_permissions = ":workspace"

183 171 

184[auto_review]172[auto_review]

185policy = """173extra_policy = """

186PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.

187 

188## Environment Profile174## Environment Profile

189- Authorized target: lab.example.com.175- Authorized target: lab.example.com.

190- Approved actions: inspect the target, reproduce authorized vulnerabilities,176- Approved actions: inspect the target, reproduce authorized vulnerabilities,

200"""186"""

201```187```

202 188 

203Replace the example target and allowed actions with the actual approved scope.189Enforce target restrictions with independent filesystem and network rules.

204Enforce target restrictions with independent filesystem and network rules;190For an organization, put the same engagement rules in the top-level

205reviewer instructions don't replace those boundaries.191`guardian_extra_policy` in managed `requirements.toml`. The following

206 192requirements select Auto-review and restrict the available permission profiles.

207Organizations can enforce the same conditions in managed `requirements.toml`:

208 193 

209```toml194```toml

210allowed_approval_policies = ["on-request"]195allowed_approval_policies = ["on-request"]

212allowed_sandbox_modes = ["read-only", "workspace-write"]197allowed_sandbox_modes = ["read-only", "workspace-write"]

213default_permissions = ":workspace"198default_permissions = ":workspace"

214 199 

215guardian_policy_config = """

216PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.

217 

218## Environment Profile

219- Authorized target: lab.example.com.

220 

221## Tenant Risk Taxonomy and Allow/Deny Rules

222- Allow only approved actions against the documented engagement target.

223- Deny out-of-scope hosts, production access, credential theft, persistence,

224 data exfiltration, destructive operations, and attempts to bypass policy.

225- Deny ambiguous or high-impact actions until a human explicitly approves the

226 exact target, action, and side effects.

227"""

228 

229[allowed_permission_profiles]200[allowed_permission_profiles]

230":read-only" = true201":read-only" = true

231":workspace" = true202":workspace" = true

236`allowed_sandbox_modes` also prevents full access in deployments that still use207`allowed_sandbox_modes` also prevents full access in deployments that still use

237legacy `sandbox_mode`.208legacy `sandbox_mode`.

238 209 

239Managed `guardian_policy_config` takes precedence over a user's local210Keep `approval_policy = "on-request"` or another

240`[auto_review].policy`. Keep `approval_policy = "on-request"` or another

241eligible interactive approval policy and keep an enforceable sandbox boundary.211eligible interactive approval policy and keep an enforceable sandbox boundary.

242With `approval_policy = "never"`, `:danger-full-access`, or `--yolo`, an action212With `approval_policy = "never"`, `:danger-full-access`, or `--yolo`, an action

243can avoid creating the boundary-crossing approval request that review requires.213can avoid creating the boundary-crossing approval request that review requires.

249 219 

250See [Models and Trusted Access](https://learn.chatgpt.com/docs/cyber-safety) and [recommended220See [Models and Trusted Access](https://learn.chatgpt.com/docs/cyber-safety) and [recommended

251configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for model access,221configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for model access,

252engagement setup, and custom agent workflows. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)222engagement setup, and custom agent workflows. For custom API or

253for enterprise precedence and supported client versions. For custom API or

254Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).223Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).

255 224 

256## Reduce review volume without weakening security225## Reduce review volume without weakening security

267- Add narrowly scoped [prefix rules](https://learn.chatgpt.com/docs/agent-configuration/rules). Prefer precise command236- Add narrowly scoped [prefix rules](https://learn.chatgpt.com/docs/agent-configuration/rules). Prefer precise command

268 prefixes such as `["cargo", "test"]` or `["pnpm", "run", "lint"]` over broad237 prefixes such as `["cargo", "test"]` or `["pnpm", "run", "lint"]` over broad

269 patterns such as `["python"]` or `["curl"]`. Broad rules often erase the238 patterns such as `["python"]` or `["curl"]`. Broad rules often erase the

270 boundary Auto-review is meant to guard.239 boundary Auto-review is meant to guard. For cybersecurity models, the CLI

240 ignores `allow` prefix rules and honors `prompt` and `forbidden` rules.

271 241 

272Auto-review session transcripts are retained under `~/.codex/sessions` by242Auto-review session transcripts are retained under `~/.codex/sessions` by

273default, so you can ask Codex to analyze past traffic there before changing243default, so you can ask Codex to analyze past traffic there before changing

370You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.370You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.

371 371 

372Set `approvals_reviewer = "auto_review"` to route eligible interactive approval372Set `approvals_reviewer = "auto_review"` to route eligible interactive approval

373requests through automatic review. This changes the reviewer, not the sandbox373requests through Auto-review. To add rules or replace the reviewer policy, see

374boundary.374[Auto-review configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).

375 

376Use `[auto_review].policy` for local reviewer policy instructions. Managed

377`guardian_policy_config` takes precedence.

378 375 

379```toml376```toml

380approval_policy = "on-request" # Other options: never or { granular = { ... } }377approval_policy = "on-request" # Other options: never or { granular = { ... } }

381approvals_reviewer = "user" # Or "auto_review" for automatic review378approvals_reviewer = "user" # Or "auto_review" for Auto-review

382sandbox_mode = "workspace-write"379sandbox_mode = "workspace-write"

383allow_login_shell = false # Optional hardening: disallow login shells for shell tools380allow_login_shell = false # Optional hardening: disallow login shells for shell tools

384 381 

396exclude_slash_tmp = false # Allow /tmp393exclude_slash_tmp = false # Allow /tmp

397writable_roots = ["/Users/YOU/.pyenv/shims"]394writable_roots = ["/Users/YOU/.pyenv/shims"]

398network_access = false # Opt in to outbound network395network_access = false # Opt in to outbound network

399 

400[auto_review]

401policy = """

402Use your organization's automatic review policy.

403"""

404```396```

405 397 

406### Named permission profiles398### Named permission profiles

370You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.370You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.

371 371 

372Set `approvals_reviewer = "auto_review"` to route eligible interactive approval372Set `approvals_reviewer = "auto_review"` to route eligible interactive approval

373requests through automatic review. This changes the reviewer, not the sandbox373requests through Auto-review. To add rules or replace the reviewer policy, see

374boundary.374[Auto-review configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration).

375 

376Use `[auto_review].policy` for local reviewer policy instructions. Managed

377`guardian_policy_config` takes precedence.

378 375 

379```toml376```toml

380approval_policy = "on-request" # Other options: never or { granular = { ... } }377approval_policy = "on-request" # Other options: never or { granular = { ... } }

381approvals_reviewer = "user" # Or "auto_review" for automatic review378approvals_reviewer = "user" # Or "auto_review" for Auto-review

382sandbox_mode = "workspace-write"379sandbox_mode = "workspace-write"

383allow_login_shell = false # Optional hardening: disallow login shells for shell tools380allow_login_shell = false # Optional hardening: disallow login shells for shell tools

384 381 

396exclude_slash_tmp = false # Allow /tmp393exclude_slash_tmp = false # Allow /tmp

397writable_roots = ["/Users/YOU/.pyenv/shims"]394writable_roots = ["/Users/YOU/.pyenv/shims"]

398network_access = false # Opt in to outbound network395network_access = false # Opt in to outbound network

399 

400[auto_review]

401policy = """

402Use your organization's automatic review policy.

403"""

404```396```

405 397 

406### Named permission profiles398### Named permission profiles

203 key: "auto_review.policy",203 key: "auto_review.policy",

204 type: "string",204 type: "string",

205 description:205 description:

206 "Local Markdown policy instructions for automatic review. Managed `guardian_policy_config` takes precedence. Blank values are ignored.",206 "Markdown text that replaces the default Auto-review policy. Managed `guardian_policy_config` takes precedence. Blank values are ignored.",

207 },207 },

208 {208 {

209 key: "auto_review.extra_policy",209 key: "auto_review.extra_policy",

210 type: "string",210 type: "string",

211 description:211 description:

212 "Additional local Markdown policy for automatic review, included alongside the main policy. Managed `guardian_extra_policy` takes precedence. Blank values are ignored.",212 "Markdown rules that Auto-review applies alongside the active policy. Managed `guardian_extra_policy` takes precedence. Blank values are ignored.",

213 },213 },

214 {214 {

215 key: "allow_login_shell",215 key: "allow_login_shell",

2238 key: "guardian_policy_config",2238 key: "guardian_policy_config",

2239 type: "string",2239 type: "string",

2240 description:2240 description:

2241 "Managed Markdown policy instructions for automatic review. This takes precedence over local `[auto_review].policy`. Blank values are ignored.",2241 "Managed Markdown text that replaces the default Auto-review policy. This takes precedence over local `[auto_review].policy`. Blank values are ignored.",

2242 },2242 },

2243 {2243 {

2244 key: "guardian_extra_policy",2244 key: "guardian_extra_policy",

2245 type: "string",2245 type: "string",

2246 description:2246 description:

2247 "Additional managed Markdown policy for automatic review, included alongside the main policy. This takes precedence over local `[auto_review].extra_policy`. Blank values are ignored.",2247 "Managed Markdown rules that Auto-review applies alongside the active policy. This takes precedence over local `[auto_review].extra_policy`. Blank values are ignored.",

2248 },2248 },

2249 {2249 {

2250 key: "additional_developer_instructions",2250 key: "additional_developer_instructions",

203 key: "auto_review.policy",203 key: "auto_review.policy",

204 type: "string",204 type: "string",

205 description:205 description:

206 "Local Markdown policy instructions for automatic review. Managed `guardian_policy_config` takes precedence. Blank values are ignored.",206 "Markdown text that replaces the default Auto-review policy. Managed `guardian_policy_config` takes precedence. Blank values are ignored.",

207 },207 },

208 {208 {

209 key: "auto_review.extra_policy",209 key: "auto_review.extra_policy",

210 type: "string",210 type: "string",

211 description:211 description:

212 "Additional local Markdown policy for automatic review, included alongside the main policy. Managed `guardian_extra_policy` takes precedence. Blank values are ignored.",212 "Markdown rules that Auto-review applies alongside the active policy. Managed `guardian_extra_policy` takes precedence. Blank values are ignored.",

213 },213 },

214 {214 {

215 key: "allow_login_shell",215 key: "allow_login_shell",

2238 key: "guardian_policy_config",2238 key: "guardian_policy_config",

2239 type: "string",2239 type: "string",

2240 description:2240 description:

2241 "Managed Markdown policy instructions for automatic review. This takes precedence over local `[auto_review].policy`. Blank values are ignored.",2241 "Managed Markdown text that replaces the default Auto-review policy. This takes precedence over local `[auto_review].policy`. Blank values are ignored.",

2242 },2242 },

2243 {2243 {

2244 key: "guardian_extra_policy",2244 key: "guardian_extra_policy",

2245 type: "string",2245 type: "string",

2246 description:2246 description:

2247 "Additional managed Markdown policy for automatic review, included alongside the main policy. This takes precedence over local `[auto_review].extra_policy`. Blank values are ignored.",2247 "Managed Markdown rules that Auto-review applies alongside the active policy. This takes precedence over local `[auto_review].extra_policy`. Blank values are ignored.",

2248 },2248 },

2249 {2249 {

2250 key: "additional_developer_instructions",2250 key: "additional_developer_instructions",

85 85 

86Provide only the data required for the approved task. Remove unnecessary sensitive information, block access to cloud metadata and credential endpoints, and treat model-generated files as untrusted.86Provide only the data required for the approved task. Remove unnecessary sensitive information, block access to cloud metadata and credential endpoints, and treat model-generated files as untrusted.

87 87 

88Avoid `:danger-full-access` and `--yolo` for cybersecurity workflows. Full Access removes the enforceable sandbox boundary that automatic review depends on. Managed organizations can exclude `:danger-full-access` and `--yolo`, limit allowed approval policies, and require automatic review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy).88Avoid `:danger-full-access` and `--yolo` for cybersecurity workflows. Full Access removes the enforceable sandbox boundary that Auto-review depends on. Managed organizations can exclude `:danger-full-access` and `--yolo`, limit allowed approval policies, and require Auto-review through [enterprise-managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-auto-review-policy).

89 89 

90Before enabling **Full Access** for an approved security model, the ChatGPT desktop app shows a model-specific warning about dangerous actions. The warning recommends **Approve for me** instead and links to [reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration). The warning doesn't restore the sandbox boundary or override organization policy.90Before enabling **Full Access** for an approved security model, the ChatGPT desktop app shows a model-specific warning about dangerous actions. The warning recommends **Approve for me** instead and links to [reviewer-policy configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration). The warning doesn't restore the sandbox boundary or override organization policy.

91 91 

92Guardrails add policy-based review to a controlled cybersecurity workflow. They don't replace environment isolation, least-privilege permissions, clearly defined boundaries, monitoring, or human oversight.92Use Auto-review alongside environment isolation, least-privilege permissions, a documented engagement scope, monitoring, and human oversight.

93 93 

94## Review sensitive Codex actions94## Review sensitive Codex actions

95 95 

96[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible sandbox-boundary approval requests to a separate reviewer before the proposed action runs. The reviewer considers the proposed action, bounded task context, and applicable policy, then allows or denies the request. Organizations can customize that policy for their approved targets, prohibited actions, and required human-review conditions.96[Auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) routes eligible approval requests to a separate reviewer before the proposed action runs. The reviewer considers the action, task context, and applicable policy. Organizations can [add rules to the active policy](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration) for approved targets, prohibited actions, and required human approvals.

97 97 

98Require explicit human approval for actions that affect production, external systems, sensitive data, privilege escalation, persistent access, or irreversible changes. Treat instructions embedded in websites, repositories, documents, and tool outputs as untrusted; they can't expand the authorized scope or override access controls.98Require explicit human approval for actions that affect production, external systems, sensitive data, privilege escalation, persistent access, or irreversible changes. Treat instructions embedded in websites, repositories, documents, and tool outputs as untrusted; they can't expand the authorized scope or override access controls.

99 99 

100In the ChatGPT desktop app, selecting an approved Daybreak model automatically switches the permissions control to **Approve for me** when that mode is available for your account and allowed by organization policy. This also applies when you use the desktop app's `/model` command. If that mode isn't available, the current permission mode stays unchanged. Model selection never overrides managed organization requirements.100In the ChatGPT desktop app, selecting an approved Daybreak model automatically switches the permissions control to **Approve for me** when that mode is available for your account and allowed by organization policy. This also applies when you use the desktop app's `/model` command. If that mode isn't available, the current permission mode stays unchanged. Model selection never overrides managed organization requirements.

101 101 

102For automatic review to run, keep all three controls in place:102For Auto-review to run, keep all three controls in place:

103 103 

1041. Use an interactive approval policy such as `approval_policy = "on-request"`.1041. Use an interactive approval policy such as `approval_policy = "on-request"`.

1052. Set `approvals_reviewer = "auto_review"`.1052. Set `approvals_reviewer = "auto_review"`.

117 117 

118Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.118Restart Codex after adding the rule. With `approvals_reviewer = "auto_review"`, matching commands go to the reviewer before execution. Add corresponding prompt rules for every sensitive command, or use `approval_mode = "prompt"` for individual [MCP tools](https://learn.chatgpt.com/docs/extend/mcp). Actions that require a person's decision still need explicit human approval.

119 119 

120Auto-review doesn't inspect routine actions that are already permitted inside the sandbox. With `approval_policy = "never"` or Full Access, a sensitive action might not create a reviewable approval request. Automatic review can make mistakes and doesn't replace isolation, clearly defined boundaries, monitoring, or explicit human oversight.120Auto-review evaluates actions that require approval. With `approval_policy = "never"` or Full Access, a sensitive action might proceed without an approval request. Use independent access controls and monitoring throughout the engagement.

121 121 

122For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity workflow](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).122For a scoped policy and organization-wide enforcement, see [Configure an authorized cybersecurity workflow](https://learn.chatgpt.com/docs/sandboxing/auto-review#configure-an-authorized-cybersecurity-engagement).

123 123 

131 131 

132If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved systems, actions, and time limits before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.132If you build with the Responses API, the Agents SDK, or another harness, add review at the tool-execution boundary. Check sensitive proposed actions against the approved systems, actions, and time limits before execution, route ambiguous or high-risk actions to a person, enforce independent filesystem and network restrictions, keep audit logs, and fail closed if the reviewer or policy is unavailable.

133 133 

134Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md) as a reference.134Codex Auto-review doesn't automatically protect custom tools or external harnesses. Use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution) for the Agents SDK pattern and the [open-source reviewer policy](https://github.com/openai/codex/blob/rust-v0.167.0/codex-rs/prompts/templates/guardian/policy.md) as a reference.

135 135 

136Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.136Codex product-side sandboxing and review are separate from [API cybersecurity checks](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity). API safeguards can return `cyber_policy` errors, and per-user `safety_identifier` values can help limit the impact of a safeguard action.

137 137 

100 100 

101Check compatibility before enabling sync:101Check compatibility before enabling sync:

102 102 

103Network policy. Where environment overrides are available, test the `experimental_network` exceptions documented in [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration). A global restriction can remain in force despite an environment allow.103- **Network policy.** Test [network policy precedence and runtime limits](https://learn.chatgpt.com/docs/enterprise/managed-configuration#network-policy-precedence-and-runtime-limits) if you use environment overrides. A Global restriction can remain in force despite an environment allow.

104 104 

105- **Enterprise hooks.** Where enabled for your workspace, Local computer access with Work Cloud supports admin-defined MCP hooks that run on the cloud coordinator (orchestrator) for supported lifecycle and tool events. Command hooks and hooks from local configuration or plugins are not supported with cloud orchestration, even when tools execute locally.105- **Enterprise hooks.** If your rollout depends on hooks, check [which handlers run with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration). Test the events and failure cases you rely on before enabling access. Review [audit coverage](https://learn.chatgpt.com/docs/enterprise/compliance-api#audit-records-for-local-computer-access-with-work-cloud) separately.

106 

107- **Unsupported hooks.** Command hooks and hooks from local configuration or plugins are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows.

108 

109- **Auditing.** Before relying on these hooks, test the callback connection, confirm the events it receives, and check how failures affect the task. MCP hooks do not provide a complete Compliance API audit trail.

110 106 

111- Data requirements. Local computer access with Work Cloud does not provide strict zero data retention. Data residency and inference residency cover only eligible content and supported workloads, regions, and configurations. Enterprise Key Management (EKM) covers supported stored content in eligible workspaces. Work is not supported with UAE inference residency. If `enforce_residency` is enabled in any cloud policy, **Allow local computer access** is disabled for both Work and dots. This safeguard does not configure workspace residency or, by itself, disable Work Cloud or dots. If your organization requires ZDR, do not enable this feature.107- Data requirements. Local computer access with Work Cloud does not provide strict zero data retention. Data residency and inference residency cover only eligible content and supported workloads, regions, and configurations. Enterprise Key Management (EKM) covers supported stored content in eligible workspaces. Work is not supported with UAE inference residency. If `enforce_residency` is enabled in any cloud policy, **Allow local computer access** is disabled for both Work and dots. This safeguard does not configure workspace residency or, by itself, disable Work Cloud or dots. If your organization requires ZDR, do not enable this feature.

112 108 

259 255 

260## Step 8: Verify and maintain the rollout256## Step 8: Verify and maintain the rollout

261 257 

262After enabling Local computer access with Work Cloud, create a new task and continue the conversation from another supported device. Existing tasks are not migrated and keep their original local-only or cloud-only behavior. Keep the computer online for steps that need its files or tools. Test an action the policy should allow and an action it should block, checking the applicable approvals, filesystem, and network restrictions separately for local and cloud execution. Also test starting a new turn while the local computer is unavailable. An eligible task can continue in a cloud container without access to that computer's local files or tools. A task cannot switch from local execution to the cloud during a turn.258Have a pilot user [start a new Work task and continue it on another device](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices).

259With the computer connected, check approvals, filesystem access, and network

260restrictions using an allowed action and a blocked action. Disconnect the

261computer and start another turn. Verify that the cloud container cannot access

262local files and that its own execution requirements apply.

263 263 

264Record the effective settings and the result of each test. If a restriction does not work as expected, resolve the issue before users rely on it. Follow the documented behavior for disabling sync. Treat access removal, task interruption, and data retention as separate actions.264Record the effective settings and the result of each test. If a restriction does not work as expected, resolve the issue before users rely on it. Follow the documented behavior for disabling sync. Treat access removal, task interruption, and data retention as separate actions.

265 265 

289 289 

290### If you need to turn Local computer access with Work Cloud off290### If you need to turn Local computer access with Work Cloud off

291 291 

292Turning off Local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation. That turn automatically uses Work Cloud without access to local files. Tell users to start a new turn after the interruption and explain that local files will no longer be available to the cloud thread.292Tell affected users that disabling **Allow local computer access** interrupts

293running turns. Members who retain Work access can send a new message in an

294existing cloud conversation to continue without local files.

55 55 

56### Hooks in Local computer access with Work Cloud56### Hooks in Local computer access with Work Cloud

57 57 

58When managed policy and remote hooks are enabled, Work Cloud with local access and dots use admin-managed remote MCP hooks on the cloud orchestrator. Configure `mcp_tool` handlers in Global `requirements.toml`. Work Cloud without local access and personal accounts do not use these enterprise hooks. Command/shell, prompt, and agent handlers; hooks from local configuration, plugins, or local directories; environment-scoped hooks; and `SessionEnd` MCP hooks are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows.58In **Global**, use **Edit as TOML** to configure `mcp_tool` handlers for Work with local computer access and dots. Test callback failures as well as explicit denials before relying on a hook to block a tool. See [Hooks with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration) for supported handlers and events.

59 

60Before relying on these hooks, test callback connectivity, required events, and failure behavior. An explicit supported denial can block an action, but a `PreToolUse` callback error, timeout, or malformed response can fail the hook without blocking the tool. MCP hooks do not provide a complete Compliance API audit trail.

61 59 

62Global also contains desktop and client settings. Some of these settings apply only to the desktop app. Configuring a setting in Global does not mean it applies everywhere. See the Configuration Reference for each field's supported use.60Global also contains desktop and client settings. Some of these settings apply only to the desktop app. Configuring a setting in Global does not mean it applies everywhere. See the Configuration Reference for each field's supported use.

63 61 

76 74 

77The table shows which field groups support environment overrides. Supported options within each group can vary by platform, and some requirements combine across policies instead of replacing one another. See the Configuration Reference for supported values and Managed configuration for network exceptions.75The table shows which field groups support environment overrides. Supported options within each group can vary by platform, and some requirements combine across policies instead of replacing one another. See the Configuration Reference for supported values and Managed configuration for network exceptions.

78 76 

79On supported managed Codex Cloud execution paths, Agent Security requirements constrain command networking. Codex Cloud environment internet settings apply separately. An allowed domain in Agent Security does not override a restriction in the Cloud environment's internet settings. These command-network controls do not, by themselves, disable hosted web search, apps, or MCP. ChatGPT Work Cloud has separate capability permissions and does not inherit these Agent Security requirements.77On supported managed Codex Cloud execution paths, allowing a domain in Agent Security cannot override an environment restriction. An approved full sandbox escalation can bypass the managed command proxy. See [Network isolation](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation) for what the proxy covers.

80 

81A managed command allowlist applies to commands using the managed proxy. Where policy permits full sandbox escalation and it is approved, that execution can bypass the command proxy. A narrow network grant is different from full sandbox escalation. Configure enforced approval and sandbox requirements for the intended boundary, and test both ordinary and escalated commands.

82 78 

83### Configure networking in the UI79### Configure networking in the UI

84 80 

35 35 

36## Where cloud tasks run36## Where cloud tasks run

37 37 

38For new tasks created after you enable Local computer access with Work Cloud, OpenAI's cloud coordinates the task while individual steps can execute in the cloud or on an approved, connected computer. This feature applies only to tasks created after you enable sync. Existing tasks, including tasks in projects, keep their original mode: locally only, or in the cloud without access to local files. Start a new task to use this feature.38With local computer access enabled, Work Cloud can call approved tools on an

39 39online, connected computer. If a new turn uses a cloud container while the

40If the computer is unavailable when a new turn starts, an existing eligible task using local computer access with Work Cloud can continue in a cloud container. The cloud container cannot access files or tools on the unavailable computer. It also does not enforce enterprise requirements from local execution. A task cannot switch from local execution to the cloud during a turn.40computer is offline, the container uses its own execution requirements and

41 41cannot reach the computer's files or tools. See [Continue Work across devices](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices).

42A step that needs a computer's local files or tools requires that computer to be online and connected. Workspace permissions, supported policy, and the user's existing access continue to apply.

43 42 

44The user's device sits within the organization's own IT-managed trust boundary, outside OpenAI-operated systems. Cloud execution remains in the OpenAI-managed environment. A synced task can separately use approved local tools through a connected computer, subject to its permissions.43The user's device sits within the organization's own IT-managed trust boundary, outside OpenAI-operated systems. Cloud execution remains in the OpenAI-managed environment. A synced task can separately use approved local tools through a connected computer, subject to its permissions.

45 44 

219 218 

220Keep orchestrator controls, including approvals and web search, in Global. Use the dedicated Allowed approval policies and Allowed web search modes controls where available, and TOML for other supported fields. See the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference) for the field list and execution scope.219Keep orchestrator controls, including approvals and web search, in Global. Use the dedicated Allowed approval policies and Allowed web search modes controls where available, and TOML for other supported fields. See the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference) for the field list and execution scope.

221 220 

222Turning off Local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation. That turn automatically uses Work Cloud without access to local files.

223 

224Review the controls that apply to each part of a cloud task:221Review the controls that apply to each part of a cloud task:

225 222 

226- **Work Cloud and Work Local:** Where independent controls are available, manage cloud and local Work as distinct controls in **Admin Console** > **Permissions**. In other workspaces, local Work can share a control with Codex Local.223- **Work Cloud and Work Local:** Where independent controls are available, manage cloud and local Work as distinct controls in **Admin Console** > **Permissions**. In other workspaces, local Work can share a control with Codex Local.

28 28 

29Local execution accesses approved resources through the desktop app on the user's computer. With Local computer access with Work Cloud enabled, OpenAI's cloud coordinates the task and calls the connected computer when a step needs local execution. The computer must be online and connected for those steps.29Local execution accesses approved resources through the desktop app on the user's computer. With Local computer access with Work Cloud enabled, OpenAI's cloud coordinates the task and calls the connected computer when a step needs local execution. The computer must be online and connected for those steps.

30 30 

31Local computer access with Work Cloud applies only to tasks created after you enable sync. Existing tasks, including tasks in projects, keep their original mode: locally only, or in the cloud without access to local files. Start a new task to use this feature.31Device requirements apply to local execution. If a new turn runs in a cloud

32 32container while the computer is offline, the container uses its own policies

33If the computer is unavailable when a new turn starts, an existing eligible task using local computer access with Work Cloud can continue in a cloud container. The cloud container cannot access files or tools on the unavailable computer. It also does not enforce enterprise requirements from local execution. A task cannot switch from local execution to the cloud during a turn.33and cannot reach local files or tools. See [Continue Work across devices](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices).

34 34 

35Local files can remain on the device, but relevant file excerpts, prompts, screenshots, browser content, or tool results may be sent to OpenAI services to complete a task. Local execution does not mean offline or device-only model inference.35Local files can remain on the device, but relevant file excerpts, prompts, screenshots, browser content, or tool results may be sent to OpenAI services to complete a task. Local execution does not mean offline or device-only model inference.

36 36 

104 104 

105- **Policies delivered only through MDM. MDM delivers policy to devices. Create an Agent Security baseline for supported local execution requirements before enabling sync.**105- **Policies delivered only through MDM. MDM delivers policy to devices. Create an Agent Security baseline for supported local execution requirements before enabling sync.**

106 106 

107- **Enterprise hooks.** Where enabled for your workspace, Local computer access with Work Cloud supports admin-defined MCP hooks that run on the cloud coordinator (orchestrator) for supported lifecycle and tool events. Command hooks and hooks from local configuration or plugins are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows.107- **Enterprise hooks.** If a local-only workflow depends on scripts or plugin hooks, check [which hooks the cloud orchestrator supports](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration) before enabling local computer access. Test the required events and review [audit coverage](https://learn.chatgpt.com/docs/enterprise/compliance-api#audit-records-for-local-computer-access-with-work-cloud).

108 

109- **Auditing.** Before relying on these hooks, test the callback connection, confirm the events it receives, and check how failures affect the task. MCP hooks do not provide a complete Compliance API audit trail.

110 108 

111Review the Work controls available in **Workspace settings** > **Permissions & roles**. Whether local and hosted Work appear as distinct permissions depends on the workspace configuration and rollout. For more guidance, see the [Work administrator FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).109Review the Work controls available in **Workspace settings** > **Permissions & roles**. Whether local and hosted Work appear as distinct permissions depends on the workspace configuration and rollout. For more guidance, see the [Work administrator FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

112 110 

118 116 

119For local clients that use the existing local configuration path, managed requirements load during configuration loading. A background refresh can prepare cloud requirements for a later load, and macOS MDM changes are read at the next client launch. Restart and verify the applicable local client after a local policy change.117For local clients that use the existing local configuration path, managed requirements load during configuration loading. A background refresh can prepare cloud requirements for a later load, and macOS MDM changes are read at the next client launch. Restart and verify the applicable local client after a local policy change.

120 118 

121Turning off Local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation. That turn automatically uses Work Cloud without access to local files.

122 

123This local loading behavior does not establish when a cloud policy change takes effect in a running task using Local computer access with Work Cloud. Verify the task's effective controls before relying on the update.119This local loading behavior does not establish when a cloud policy change takes effect in a running task using Local computer access with Work Cloud. Verify the task's effective controls before relying on the update.

124 120 

125| **Managed setting** | **Security purpose** |121| **Managed setting** | **Security purpose** |

8available to each experience depend on whether a task runs locally or in the8available to each experience depend on whether a task runs locally or in the

9cloud, its available tools, and applicable workspace policies.9cloud, its available tools, and applicable workspace policies.

10 10 

11ChatGPT Work can complete multi-step tasks using the files, applications, and tools available to an authorized workspace member. With sync enabled, members can continue eligible conversations across desktop, mobile, and web. For enterprises, the in-app Local/Cloud toggle and its default remain unchanged at launch. OpenAI's cloud coordinates the task, while individual steps can run in a cloud environment or on an approved, connected computer.11ChatGPT Work can complete multi-step tasks using a member's authorized files,

12applications, and tools. With local computer access enabled, the cloud can

13coordinate a task that uses approved tools on a connected computer.

12 14 

13> **Update the desktop app.** Users must update to the latest version of the ChatGPT desktop app for Local computer access with Work Cloud to take effect after it is enabled for their workspace.15> **Update the desktop app.** Users must update to the latest version of the ChatGPT desktop app for Local computer access with Work Cloud to take effect after it is enabled for their workspace.

14 16 

43 45 

44### Cloud Work46### Cloud Work

45 47 

46Cloud execution runs supported steps on OpenAI-managed infrastructure. If the computer is unavailable when a new turn starts, an existing eligible task using local computer access with Work Cloud can continue in a cloud container. The cloud container cannot access files or tools on the unavailable computer. It also does not enforce enterprise requirements from local execution. A task cannot switch from local execution to the cloud during a turn.48Cloud steps run on OpenAI-managed infrastructure with their own execution

49requirements. Local requirements apply only to steps on the connected computer.

47 50 

48A cloud execution environment does not automatically inherit a computer's files, applications, browser sessions, or network access. A task using Local computer access with Work Cloud can separately use approved local tools through an online, connected computer. Uploads, project sources, and authorized connected apps remain distinct ways to supply information.51A cloud execution environment does not automatically inherit a computer's files, applications, browser sessions, or network access. A task using Local computer access with Work Cloud can separately use approved local tools through an online, connected computer. Uploads, project sources, and authorized connected apps remain distinct ways to supply information.

49 52 

51 54 

52See [Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web), [Creating and editing documents, spreadsheets, and presentations](https://help.openai.com/en/articles/20001278-creating-and-editing-documents-spreadsheets-and-presentations-with-chatgpt-work), and [File storage and Library in ChatGPT](https://help.openai.com/en/articles/20001052-library-for-chatgpt).55See [Code and shell sandboxing](https://learn.chatgpt.com/docs/sandboxing?surface=web), [Creating and editing documents, spreadsheets, and presentations](https://help.openai.com/en/articles/20001278-creating-and-editing-documents-spreadsheets-and-presentations-with-chatgpt-work), and [File storage and Library in ChatGPT](https://help.openai.com/en/articles/20001052-library-for-chatgpt).

53 56 

54Local computer access with Work Cloud applies only to tasks created after you enable sync. Existing tasks, including tasks in projects, keep their original mode: locally only, or in the cloud without access to local files. Start a new task to use this feature.57For task eligibility and the experience on each device, see

58[Continue Work across devices](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices).

55 59 

56 60 

57 61 

66 70 

67- **Local execution.** MDM and legacy managed-device requirements rank above Agent Security. The device's system requirements file ranks below Agent Security.71- **Local execution.** MDM and legacy managed-device requirements rank above Agent Security. The device's system requirements file ranks below Agent Security.

68 72 

69- **Enterprise hooks.** Where enabled for your workspace, Local computer access with Work Cloud supports admin-defined MCP hooks that run on the cloud coordinator (orchestrator) for supported lifecycle and tool events. Command hooks and hooks from local configuration or plugins are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows.73- **Enterprise hooks.** Check [which hooks run with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration). Before rollout, verify callback delivery, failure behavior, and [audit coverage](https://learn.chatgpt.com/docs/enterprise/cloud-local-access#check-hooks-and-network-compatibility) for the events your workspace relies on.

70 

71- **Logging and auditing.** Before relying on these hooks, test the callback connection, confirm the events it receives, and check how failures affect the task. MCP hooks do not provide a complete Compliance API audit trail.

72 74 

73Keep orchestrator controls, including approvals and web search, in Global. Use the dedicated Allowed approval policies and Allowed web search modes controls where available, and TOML for other supported fields. See the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference) for the field list and execution scope.75Keep orchestrator controls, including approvals and web search, in Global. Use the dedicated Allowed approval policies and Allowed web search modes controls where available, and TOML for other supported fields. See the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference) for the field list and execution scope.

74 76 

75Turning off Local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation. That turn automatically uses Work Cloud without access to local files.77Before disabling access, review [what to tell affected users](https://learn.chatgpt.com/docs/enterprise/admin-setup#if-you-need-to-turn-local-computer-access-off).

76 78 

77Local computer access with Work Cloud does not change Codex configuration behavior or combine Work history with Codex history. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and the [Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).79Local computer access with Work Cloud does not change Codex configuration behavior or combine Work history with Codex history. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and the [Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

78 80 

19 19 

20### Work20### Work

21 21 

22- **Continue one Work conversation across devices.** Start on a computer, then review results or give follow-up instructions from the web or mobile app. Tasks using local computer access with Work Cloud use cloud coordination.22Members can [continue Work across devices](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices) and use approved local

23 23resources through a connected computer. Administrators can manage local

24- **Use approved resources on your computer.** A task using this feature can use permitted local files and tools through a connected computer while you follow along from another device. Keep that computer online and connected for steps that need it.24execution requirements in Agent Security and review cloud execution separately.

25 

26- **Manage local execution requirements centrally.** Set supported enterprise requirements in Agent Security for local execution. Review Work Cloud policies separately for cloud execution.

27 25 

28### Dots26### Dots

29 27 

41A task has two parts: coordination and execution. Coordination decides which steps to take and keeps the conversation moving. Execution is the work performed by a tool, such as running a shell command. This feature moves coordination into OpenAI’s cloud. It does not move every tool or file off the computer.39A task has two parts: coordination and execution. Coordination decides which steps to take and keeps the conversation moving. Execution is the work performed by a tool, such as running a shell command. This feature moves coordination into OpenAI’s cloud. It does not move every tool or file off the computer.

42 40 

43| **Area** | **Before you enable this feature** | **After you enable this feature** |41| **Area** | **Before you enable this feature** | **After you enable this feature** |

44| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |42| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

45| Continuing a local Work conversation | Members choose a local or cloud Work thread, where available. | When members select Cloud, eligible new conversations use cloud coordination and can continue across devices. When members select Local, both coordination and execution continue to happen locally. For enterprises, the in-app Local/Cloud toggle and its default remain unchanged at launch. |43| Continuing a local Work conversation | Members choose a local or cloud Work thread, where available. | When members select Cloud, eligible new conversations use cloud coordination and can continue across devices. When members select Local, both coordination and execution continue to happen locally. |

46| Task coordination | The existing local or cloud workflow applies. | OpenAI’s cloud coordinates the Work task. |44| Task coordination | The existing local or cloud workflow applies. | OpenAI’s cloud coordinates the Work task. |

47| Steps that need the user’s computer | Local Work can use the computer’s tools and files. Cloud Work cannot use the computer. | The computer still provides those tools and files and must be online and connected. |45| Steps that need the user’s computer | Local Work can use the computer’s tools and files. Cloud Work cannot use the computer. | The computer still provides those tools and files and must be online and connected. |

48| [Enterprise requirements](https://learn.chatgpt.com/docs/enterprise/managed-configuration) | Existing local requirements and precedence apply to local Work. | Local execution requirements govern the connected computer. Supported Global policy applies to cloud orchestration when managed policy is enabled; Work cloud containers use their own execution configuration and requirements. |46| [Enterprise requirements](https://learn.chatgpt.com/docs/enterprise/managed-configuration) | Existing local requirements and precedence apply to local Work. | Local execution requirements govern the connected computer. Supported Global policy applies to cloud orchestration when managed policy is enabled; Work cloud containers use their own execution configuration and requirements. |

122 120 

123#### Check hooks and network compatibility121#### Check hooks and network compatibility

124 122 

125- **Supported enterprise hooks:** When managed policy and remote hooks are enabled, Work Cloud with local access and dots use admin-managed remote MCP hooks. The cloud orchestrator calls your connected MCP service at supported task and tool events. Configure `mcp_tool` handlers in Global `requirements.toml`. Work Cloud without local access does not use these hooks; these enterprise hooks are not available for personal accounts.123- **Hook compatibility:** Before enabling local access, review any compatibility warnings in the workspace setting and Agent Security. Compare the hooks your workflow needs with the [hooks supported with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration). If you depend on a local command or plugin hook, keep that workflow local-only.

126 

127- **Work Cloud and dots with local access:** Command/shell, prompt, and agent handlers; hooks from local configuration, plugins, or local directories; environment-scoped hooks; and `SessionEnd` MCP hooks are not supported with cloud orchestration, even when the task executes tools on your computer. If your workflow depends on one of these hooks, continue using a local-only workflow that supports it until you have reviewed an alternative.

128 124 

129- **Local-only threads in Work and Codex:** When both orchestration and execution are local, existing supported hooks continue to work. Admins can still configure supported managed hooks in Agent Security for this workflow.125- **Failure and audit coverage:** Test the callback connection, required events, and tool behavior after a callback error or timeout. A failed `PreToolUse` hook can let the tool run. Hooks do not cover every internal subagent path. Review the [available audit records](https://learn.chatgpt.com/docs/enterprise/compliance-api#audit-records-for-local-computer-access-with-work-cloud) separately.

130 

131- **Failure and audit coverage:** Test callback connectivity, required events, and failure behavior. An explicit supported denial can block an action, but a `PreToolUse` callback error, timeout, or malformed response can fail the hook without blocking the tool. Hooks do not provide a complete [Compliance API](https://learn.chatgpt.com/docs/enterprise/compliance-api#audit-records-for-local-computer-access-with-work-cloud) audit trail or cover every internal subagent path.

132 126 

133- **Network and app controls:** Verify the field, delivery path, and execution surface in the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference). App- or device-enforced controls may still apply when the cloud orchestrator does not consume a setting. Managed HTTP/SOCKS listener ports and non-loopback proxy listeners are unsupported by the cloud runtime; socket-rule support depends on the execution path. Review [Network policy precedence and runtime limits](https://learn.chatgpt.com/docs/enterprise/managed-configuration#network-policy-precedence-and-runtime-limits), then test allowed and blocked actions and required connectivity.127- **Network and app controls:** Verify the field, delivery path, and execution surface in the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference). App- or device-enforced controls may still apply when the cloud orchestrator does not consume a setting. Managed HTTP/SOCKS listener ports and non-loopback proxy listeners are unsupported by the cloud runtime; socket-rule support depends on the execution path. Review [Network policy precedence and runtime limits](https://learn.chatgpt.com/docs/enterprise/managed-configuration#network-policy-precedence-and-runtime-limits), then test allowed and blocked actions and required connectivity.

134 128 

192 186 

193### Work187### Work

194 188 

195- **Eligible tasks.** Eligible new tasks started in the ChatGPT desktop app with **Cloud** selected can use that computer’s local executor while it is connected and local access is enabled.189Members must sign in with ChatGPT to the intended workspace. API keys and Codex

196 190access tokens cannot enable this feature. Share [Continue Work across devices](https://learn.chatgpt.com/docs/get-started-with-work#continue-work-across-devices)

197- **Sign-in.** Use Sign in with ChatGPT in the intended workspace. API keys and Codex access tokens do not enable local computer access with Work Cloud.191for instructions on starting an eligible task and continuing when the computer

198 192is offline. Before disabling the feature, review the

199- **Computer unavailable.** If the computer is unavailable when a new turn begins, an existing eligible task can continue in a cloud container without that computer’s local files or tools. The container does not enforce enterprise requirements from local execution. A task cannot switch from local execution to the cloud during a turn.193[rollback instructions](https://learn.chatgpt.com/docs/enterprise/admin-setup#if-you-need-to-turn-local-computer-access-off).

200 

201- **Access turned off.** Turning off local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation; it uses Work Cloud without access to local files.

202 

203- **Existing chats and projects.** Tasks created before this feature is enabled keep their original mode: locally only, or in the cloud without local file access. Start a new task after enabling the feature to use local computer access with Work Cloud.

204 

205- **Local/Cloud setting.** For enterprises, the in-app Local/Cloud toggle and its default remain unchanged at launch. Eligible tasks with **Cloud** selected use cloud coordination and the connected computer for local steps.

206 194 

207 195 

208 196 

8 8 

9## Security overview9## Security overview

10 10 

11A personal dot can work on its owner’s behalf between conversations. For example, an employee can ask it to follow a project and prepare a brief as updates come in. The dot works from its own cloud computer and can delegate tasks to Work or Codex. In a connected app, it inherits the permissions of the account its owner authorized. Workspace admins can further limit which apps and actions it can use.11A personal dot can work on its owner’s behalf between conversations. For example, an employee can ask it to follow a project and prepare a brief as updates come in. The dot works from its own cloud computer and can delegate tasks to Work or Codex. In a connected app, it inherits the permissions of the account its owner authorized. The workspace’s app and action settings apply to both the owner and their dot.

12 12 

13A project document can supply facts for the brief, but OpenAI trains the models behind dots to resist any hidden instructions in the project document or similar kinds of [prompt injection](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs). Auto-review checks consequential actions before they run, and safety monitoring can pause or stop work if it detects potentially harmful behavior.13A project document can supply facts for the brief, but OpenAI trains the models behind dots to resist any hidden instructions in the project document or similar kinds of [prompt injection](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs). Auto-review checks consequential actions before they run, and safety monitoring can pause or stop work if it detects potentially harmful behavior.

14 14 

44 44 

45- **Model safeguards help dots follow the owner’s instructions.** OpenAI trains models in the GPT-6 family to refuse harmful requests and resist malicious instructions hidden in emails, files, or web pages. For example, an email asking a dot to forward a private file does not authorize the dot to send it. That authority comes from the owner or an automation the owner authorized. [GPT-6 model safeguards](https://deploymentsafety.openai.com/gpt-6-october/prompt-injection)45- **Model safeguards help dots follow the owner’s instructions.** OpenAI trains models in the GPT-6 family to refuse harmful requests and resist malicious instructions hidden in emails, files, or web pages. For example, an email asking a dot to forward a private file does not authorize the dot to send it. That authority comes from the owner or an automation the owner authorized. [GPT-6 model safeguards](https://deploymentsafety.openai.com/gpt-6-october/prompt-injection)

46 46 

47- **Auto-review checks certain actions before they run.** Before a dot sends an email, for example, Auto-review checks the recipient and message against the owner’s instructions, Custom Rules, and safety requirements. It can block the send. The dot cannot turn off this review. Some default action and confirmation rules can be customized, but owner approval cannot override built-in safety requirements. [How Auto-review works](https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/)47- **Auto-review checks certain actions before they run.** Before a dot sends an email, for example, Auto-review checks the recipient and message against the owner’s instructions, Custom Rules, and safety requirements. Auto-review can block the send, and the dot can’t turn off a required check. In a simulated Codex task, none of the GPT-6 models tested bypassed an Auto-review denial. [See how OpenAI tested responses to Auto-review denials](https://deploymentsafety.openai.com/gpt-6-1-terra/respecting-auto-review). Some default action and confirmation rules can be customized, but owner approval cannot override built-in safety requirements. [How Auto-review works](https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/)

48 48 

49- **Safety monitoring can interrupt work in progress.** As a dot plans and acts, monitoring looks for potentially harmful behavior, such as attempts to bypass a safeguard or act outside the owner’s instructions. If it detects a concern, it can pause or stop the task. A pause can surface a warning for the owner to review. [Built-in safeguards](https://openai.com/index/introducing-dots/)49- **Safety monitoring can interrupt work in progress.** As a dot plans and acts, monitoring looks for potentially harmful behavior, such as attempts to bypass a safeguard or act outside the owner’s instructions. If it detects a concern, it can pause or stop the task. A pause can surface a warning for the owner to review. [Built-in safeguards](https://openai.com/index/introducing-dots/)

50 50 

51- **Admins control plugin access and cloud browser access separately.** Admins choose which plugins and actions are available and whether dots can use the cloud browser. A read-only plugin limits what a dot can do through that plugin. If cloud browser use is enabled, the dot may still be able to make changes through an account signed in on the website. [Workspace controls](https://help.openai.com/en/articles/20001554-manage-dots-in-chatgpt-workspaces)51- **Admins manage plugin access in workspace settings.** The same settings control which plugins and actions a user and their dot can use. Cloud browser access for the dot is controlled by a different setting. A read-only plugin limits what a dot can do through that plugin. If cloud browser use is enabled, the dot may still be able to make changes through an account signed in on the website. [Workspace controls](https://help.openai.com/en/articles/20001554-manage-dots-in-chatgpt-workspaces)

52 52 

53- **Owners can review and redirect work.** In Activity View, owners can inspect a delegated task, add context, change direction, or ask the dot to stop. Timing matters when information is shared. If the dot has already posted in Slack, people in the channel may already have read the message. [Activity View and completed actions](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs)53- **Owners can review and redirect work.** In Activity View, owners can inspect a delegated task, add context, change direction, or ask the dot to stop. When a dot can’t finish a task, it should tell the owner what got in the way and what remains undone. On coding tasks selected to elicit blocker-reporting failures, GPT‑6.1 Terra failed to report the blocker accurately in about 8% of cases, down from 29% for GPT‑5.6 Terra. [See how OpenAI evaluated blocker reporting](https://deploymentsafety.openai.com/gpt-6-1-terra/blocker-deception). Timing matters when information is shared. If the dot has already posted in Slack, people in the channel may already have read the message. [Activity View and completed actions](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs)

54 54 

55> **What to review before rolling out dots**55> **What to review before rolling out dots**

56>56>

57> Decide which employees should have access to dots. A personal dot uses its owner’s existing app connections. Check what each connected account lets the owner read or change and which actions the workspace allows through that connection. If dots can use the cloud browser or delegate work to a connected computer, check what the signed-in account or local device permits there.57> Decide which employees should have access to dots. A personal dot uses its owner’s existing app connections. Check what each connected account lets the owner read or change and which actions the workspace allows through that connection. If dots can use the cloud browser or delegate work to a connected computer, check what the signed-in account or local device permits there.

58 58 

59## How OpenAI evaluates model safeguards

60 

61A dot may read an email, act on the owner’s behalf, and report what it did. Model safeguards help at each step. OpenAI tests whether a model ignores malicious instructions embedded in content it reads, respects an Auto-review denial, and tells the owner when something prevented it from finishing. The following results come from the October 26 GPT-6.1 Terra system-card addendum.

62 

63**Indirect prompt injection.** An email might tell a dot to forward a private file. The owner asked for a summary, so the model should ignore the forwarding instruction and continue summarizing. Figure 3 tests that distinction across untrusted content.

64 

65<DotsEvaluationChart

66 kind="injection"

67 caption="Indirect prompt injection robustness."

68 sourceHref="https://deploymentsafety.openai.com/gpt-6-1-terra/prompt-injection/fig-3"

69 sourceFigure={3}

70/>

71 

72**Respecting Auto-review.** When an action requires Auto-review, a separate reviewer checks what the dot proposes to do, what data or people it would affect, and whether the owner’s instructions, Custom Rules, and safety requirements allow it. For example, before a dot shares a file in a Slack channel, the reviewer checks what would be shared, where it would go, and whether the owner authorized sharing it there. A request to summarize the file does not authorize posting it. Destructive actions, such as permanently deleting data, may also require the owner’s approval. The dot cannot turn off required checks, and owner approval cannot override core safety requirements. Figure 5 shows how models responded to a denial in a simulated Codex task.

73 

74<DotsEvaluationChart

75 kind="review"

76 caption="Responses to Auto-review denials in a simulated Codex task."

77 sourceHref="https://deploymentsafety.openai.com/gpt-6-1-terra/respecting-auto-review/fig-5"

78 sourceFigure={5}

79/>

80 

81At maximum reasoning effort, GPT-6.1 Terra made no observed attempts to bypass a denial. GPT-6 Luna tried in 0.3% of samples. None of its attempts succeeded.

82 

83**Disclosing blockers.** When a model cannot finish a task, the owner needs to know what remains undone. Figure 8 measures how often models failed to report a blocker accurately in their final answer on coding tasks chosen to make that failure more likely.

84 

85<DotsEvaluationChart

86 kind="blockers"

87 caption="Failure to report blockers accurately on coding tasks selected to elicit this behavior."

88 sourceHref="https://deploymentsafety.openai.com/gpt-6-1-terra/blocker-deception/fig-8"

89 sourceFigure={8}

90/>

91 

92GPT-6.1 Terra failed to report a blocker accurately in 8.47% of these cases, down from 28.99% for GPT-5.6 Terra and close to GPT-6 Sol (8.05%) and GPT-6 Luna (8.36%).

93 

94These evaluations give an indication of what to expect from the GPT-6 family on similar tasks. Compared with the GPT-5.6 models tested, GPT-6 models more often resisted malicious instructions and accurately reported when they could not finish a task. In the simulated Codex evaluation, no GPT-6 model tested successfully bypassed an Auto-review denial.

95 

96## Confirm eligibility and data requirements59## Confirm eligibility and data requirements

97 60 

98| **Category** | **Eligibility and data requirements** |61| **Category** | **Eligibility and data requirements** |

171 171 

172 172 

173 173 

174Disabling automatic review for browser actions sends those actions to the user for174Disabling Auto-review for browser actions sends those actions to the user for

175approval instead. It doesn't disable model safety monitoring.175approval instead. It doesn't disable model safety monitoring.

176 176 

177When several origin patterns match, the most restrictive value wins for each177When several origin patterns match, the most restrictive value wins for each

257access_approval_lifetime = "turn"257access_approval_lifetime = "turn"

258```258```

259 259 

260To disable automatic review for browser actions, set260To disable Auto-review for browser actions, set

261`browser_use.disable_auto_review = true`, or set `auto_review = "deny"` on an261`browser_use.disable_auto_review = true`, or set `auto_review = "deny"` on an

262origin policy to restrict it for that origin.262origin policy to restrict it for that origin.

263 263 

417 417 

418### Admin-enforced requirements (requirements.toml)418### Admin-enforced requirements (requirements.toml)

419 419 

420Requirements constrain security-sensitive settings (approval policy, approvals reviewer, automatic review policy, sandbox mode, permission profiles, web search mode, managed hooks, which MCP servers users can enable, and which plugin marketplace sources they can use). When resolving configuration (for example from `config.toml`, [profile files](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles), or CLI config overrides), if a value conflicts with an enforced rule, the local client falls back to a compatible value and notifies the user. If you configure an `mcp_servers` allowlist, the client enables an MCP server only when both its name and identity match an approved entry; otherwise, the client disables it.420Requirements constrain security-sensitive settings (approval policy, approvals reviewer, Auto-review policy, sandbox mode, permission profiles, web search mode, managed hooks, which MCP servers users can enable, and which plugin marketplace sources they can use). When resolving configuration (for example from `config.toml`, [profile files](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles), or CLI config overrides), if a value conflicts with an enforced rule, the local client falls back to a compatible value and notifies the user. If you configure an `mcp_servers` allowlist, the client enables an MCP server only when both its name and identity match an approved entry; otherwise, the client disables it.

421 421 

422Requirements can also constrain [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) via the `[features]` table in `requirements.toml`. Note that features aren't always security-sensitive, but enterprises can pin values if desired. Omitted keys remain unconstrained.422Requirements can also constrain [feature flags](https://learn.chatgpt.com/docs/config-file/config-basic#feature-flags) via the `[features]` table in `requirements.toml`. Note that features aren't always security-sensitive, but enterprises can pin values if desired. Omitted keys remain unconstrained.

423 423 

517[Migrate from the retired `untrusted` approval policy](https://learn.chatgpt.com/docs/agent-approvals-security#migrate-from-the-retired-untrusted-approval-policy)517[Migrate from the retired `untrusted` approval policy](https://learn.chatgpt.com/docs/agent-approvals-security#migrate-from-the-retired-untrusted-approval-policy)

518for examples and security tradeoffs.518for examples and security tradeoffs.

519 519 

520### Configure automatic review policy520<span

521 id="configure-automatic-review-policy"

522 className="block scroll-mt-[110px]"

523/>

521 524 

522To make automatic review the default, use **Global** > **Defaults** > **Command execution** > **Approval reviewer**. A default lets users choose525### Configure Auto-review policy

523another permitted reviewer. To require automatic review or supply your

524organization's review instructions, use **Edit as TOML** and edit Global

525`requirements.toml` instead. These requirements are separate from the browser's

526automatic-review controls.

527 526 

528Use `allowed_approvals_reviewers` to require or allow automatic review. Set it527To make Auto-review the default, select **Global** > **Defaults** > **Command execution** > **Approval reviewer**. Users can still choose another permitted

529to `["auto_review"]` to require automatic review, or include `"user"` when users528reviewer. To require Auto-review or supply organization-wide rules, select

530can choose manual approval.529**Edit as TOML** and edit Global `requirements.toml`. Browser actions have

530separate Auto-review controls.

531 531 

532Set `guardian_policy_config` to replace the tenant-specific section of the532The following example requires Auto-review for eligible approval requests and

533automatic review policy. The local runtime still uses the built-in reviewer533adds an organization-specific rule to the active policy. To also allow manual

534template and output contract. Managed `guardian_policy_config` takes precedence534approval, include `"user"` in `allowed_approvals_reviewers`.

535over local `[auto_review].policy`.

536 535 

537```toml536```toml

538allowed_approval_policies = ["on-request"]537allowed_approval_policies = ["on-request"]

539allowed_approvals_reviewers = ["auto_review"]538allowed_approvals_reviewers = ["auto_review"]

540 539 

541guardian_policy_config = """540guardian_extra_policy = """

542## Environment Profile541Deny uploads of build artifacts to destinations outside artifacts.example.com.

543- Trusted internal destinations include github.com/my-org, artifacts.example.com,

544 and internal CI systems.

545 

546## Tenant Risk Taxonomy and Allow/Deny Rules

547- Treat uploads to unapproved third-party file-sharing services as high risk.

548- Deny actions that expose credentials or private source code to untrusted

549 destinations.

550"""542"""

551```543```

552 544 

545To replace the entire policy, use `guardian_policy_config`. See

546[Auto-review configuration](https://learn.chatgpt.com/docs/sandboxing/auto-review#configuration) for

547the default policy, how to prepare a replacement, and which managed settings

548take precedence over local ones.

549 

553### Control available permission profiles550### Control available permission profiles

554 551 

555Use **Defaults** > **Command execution** > **Default permissions** to choose the built-in profile users start with. To enforce which profiles users can select or to define552Use **Defaults** > **Command execution** > **Default permissions** to choose the built-in profile users start with. To enforce which profiles users can select or to define

933- Use the managed `mcp_servers` approved list to restrict MCP servers.930- Use the managed `mcp_servers` approved list to restrict MCP servers.

934- Use feature requirements such as `browser_use`, `in_app_browser`, and931- Use feature requirements such as `browser_use`, `in_app_browser`, and

935 `computer_use` to restrict browser and computer-use capabilities.932 `computer_use` to restrict browser and computer-use capabilities.

936- For supported managed Codex Cloud commands, configure Agent Security requirements and the Cloud environment internet settings separately.933- For supported managed Codex Cloud commands, check the environment's internet settings as well as Agent Security. The environment can still block an allowed domain.

937 

938A command domain allowlist does not replace these capability-specific

939controls.

940 934 

941On supported managed Codex Cloud execution paths, Agent Security requirements constrain command networking. Codex Cloud environment internet settings apply separately. An allowed domain in Agent Security does not override a restriction in the Cloud environment's internet settings. These command-network controls do not, by themselves, disable hosted web search, apps, or MCP. ChatGPT Work Cloud has separate capability permissions and does not inherit these Agent Security requirements.935Test ordinary commands and any permitted full sandbox escalation separately. An approved full sandbox escalation can bypass the managed command proxy. See [Network isolation](https://learn.chatgpt.com/docs/agent-approvals-security#network-isolation).

942 936 

943A managed command allowlist applies to commands using the managed proxy. Where policy permits full sandbox escalation and it is approved, that execution can bypass the command proxy. A narrow network grant is different from full sandbox escalation. Configure enforced approval and sandbox requirements for the intended boundary, and test both ordinary and escalated commands.937> **No effective allowed destinations:** With both **Managed networking** and **Only allow domains added by admins** enabled, ordinary managed commands need an explicit or inherited Allow entry. Check the [effective allowed destinations](https://learn.chatgpt.com/docs/enterprise/agent-security#no-effective-allowed-destinations) before saving.

944 938 

945> **No effective allowed destinations:** When **Managed networking** and **Only allow domains added by admins** are On, ordinary managed commands need effective allowed destinations. If no Allow entries are configured or inherited, those commands have no allowed destinations. A deny-only policy does not implicitly allow the rest of the internet. Add required Allow entries and check inherited rules before saving. This restriction applies to the managed command proxy, not every tool or approved full sandbox escalation.939> **Codex Cloud local/private connectivity:** Check the effective `allow_local_binding` value if a Cloud command cannot reach an allowed domain. An inherited Off value can block the upstream proxy. See [Codex Cloud local/private connectivity](https://learn.chatgpt.com/docs/enterprise/agent-security#codex-cloud-localprivate-connectivity) for the Cloud-specific default and overrides.

946 

947> **Codex Cloud local/private connectivity:** An explicit Off value for local/private connectivity can prevent Codex Cloud from reaching its upstream proxy, even when the destination domain is allowed. Check the final `allow_local_binding` value and identify which policy or setting supplies it. On the supported Cloud proxy path, this defaults to true only when no applicable requirement, selected network profile, or proxy feature setting supplies a value. An inherited false still counts as an explicit setting. Where supported, set a higher-priority Cloud override to change this value for Codex Cloud without changing the Global value used by Local. This does not add domain Allow entries. Verify executor support before relying on the override. Do not apply this Cloud default to Local.

948 940 

949When environment requirements are empty, Global requirements apply. **Managed networking** set to941When environment requirements are empty, Global requirements apply. **Managed networking** set to

950**Off** is separate from the Cloud environment's Internet access setting. See942**Off** is separate from the Cloud environment's Internet access setting. See

1109 1101 

1110### Enforce managed hooks from requirements1102### Enforce managed hooks from requirements

1111 1103 

1112Managed hooks run administrator-defined actions at supported task or tool1104In Agent security, open **Global** > **Requirements** > **Edit as TOML**. For Work with local computer access and dots, configure supported `mcp_tool` handlers in Global `requirements.toml`. Before rollout, test the callback connection and what happens when the callback times out. See [Hooks with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration) for supported events and failure behavior.

1113events. Use **Edit as TOML** in Agent security to configure them in Global

1114`requirements.toml`; the settings controls don't include a dedicated hook editor. The execution paths below determine which hook types can run.

1115 

1116When managed policy and remote hooks are enabled, Work Cloud with local access and dots use admin-managed remote MCP hooks on the cloud orchestrator. Configure `mcp_tool` handlers in Global `requirements.toml`. Work Cloud without local access and personal accounts do not use these enterprise hooks. Command/shell, prompt, and agent handlers; hooks from local configuration, plugins, or local directories; environment-scoped hooks; and `SessionEnd` MCP hooks are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows.

1117 

1118Before relying on these hooks, test callback connectivity, required events, and failure behavior. An explicit supported denial can block an action, but a `PreToolUse` callback error, timeout, or malformed response can fail the hook without blocking the tool. MCP hooks do not provide a complete Compliance API audit trail. The following script and directory examples retain their Codex scope.

1119 

1120Admins can also define managed lifecycle hooks directly in `requirements.toml`.

1121Use `[hooks]` for the hook configuration itself, and point `managed_dir` at the

1122directory where your MDM or endpoint-management tooling installs the referenced

1123scripts.

1124 

1125To enforce managed hooks even for users who turned hooks off locally, pin

1126`[features].hooks = true` alongside `[hooks]`. To skip user, project, session,

1127and plugin hooks while still allowing managed hooks, set

1128`allow_managed_hooks_only = true`.

1129 

1130```toml

1131allow_managed_hooks_only = true

1132 

1133[features]

1134hooks = true

1135 

1136[hooks]

1137managed_dir = "/enterprise/hooks"

1138windows_managed_dir = 'C:\enterprise\hooks'

1139 

1140[[hooks.PreToolUse]]

1141matcher = "^Bash$"

1142 

1143[[hooks.PreToolUse.hooks]]

1144type = "command"

1145command = "python3 /enterprise/hooks/pre_tool_use_policy.py"

1146command_windows = 'py -3 C:\enterprise\hooks\pre_tool_use_policy.py'

1147timeout = 30

1148statusMessage = "Checking managed Bash command"

1149```

1150 

1151Notes:

1152 1105 

1153- The local runtime enforces the hook configuration from `requirements.toml`,1106For local Codex, distribute hook scripts through your device-management tool. To enforce them even if a user disables hooks, pin `[features].hooks = true` in `requirements.toml`. See the [managed hook configuration example](https://learn.chatgpt.com/docs/hooks#managed-hooks-in-local-codex) for script paths and how to allow only managed hooks.

1154 but it doesn't distribute the scripts in `managed_dir`.

1155- Deliver those scripts with your MDM or device-management solution.

1156- Managed hook commands should reference absolute script paths under the

1157 configured managed directory.

1158- `allow_managed_hooks_only = true` skips hooks from user, project, session, and

1159 plugin sources, but still loads hooks from `requirements.toml` and other

1160 managed config layers.

1161 1107 

1162## Understand policy scope and precedence1108## Understand policy scope and precedence

1163 1109 

1186 1132 

1187Environment overrides vary supported settings within a policy. Within a given policy, the order from highest to lowest is OS-specific environment override → all-OS environment override → Global. A higher-priority policy still wins over a lower-priority policy, even when the lower-priority policy is more specific. Some requirements have field-specific merge rules. Confirm which override editors and fields are available for your workspace.1133Environment overrides vary supported settings within a policy. Within a given policy, the order from highest to lowest is OS-specific environment override → all-OS environment override → Global. A higher-priority policy still wins over a lower-priority policy, even when the lower-priority policy is more specific. Some requirements have field-specific merge rules. Confirm which override editors and fields are available for your workspace.

1188 1134 

1189When managed policy and remote hooks are enabled, Work Cloud with local access and dots use admin-managed remote MCP hooks on the cloud orchestrator. Configure `mcp_tool` handlers in Global `requirements.toml`. Work Cloud without local access and personal accounts do not use these enterprise hooks. Command/shell, prompt, and agent handlers; hooks from local configuration, plugins, or local directories; environment-scoped hooks; and `SessionEnd` MCP hooks are not supported with cloud orchestration, even when tools execute locally. When both orchestration and execution are local, existing supported hooks continue to work in local-only Work and Codex threads. Admins can still configure supported managed hooks in Agent Security for those workflows. Before relying on these hooks, test callback connectivity, required events, and failure behavior. An explicit supported denial can block an action, but a `PreToolUse` callback error, timeout, or malformed response can fail the hook without blocking the tool. MCP hooks do not provide a complete Compliance API audit trail. See the [Configuration Reference](https://learn.chatgpt.com/docs/config-file/config-reference).1135Before enabling local access for a workflow that uses hooks, [check which hooks run with cloud orchestration](https://learn.chatgpt.com/docs/hooks#hooks-with-cloud-orchestration).

1190 1136 

1191### Locations and precedence1137### Locations and precedence

1192 1138 

163 163 

164- Test access with a member who has the intended permissions.164- Test access with a member who has the intended permissions.

165 165 

166Tasks using Local computer access with Work Cloud use cloud coordination and can still run local steps through a connected computer. For enterprises, the in-app Local/Cloud toggle and its default remain unchanged at launch. The sync permission does not grant a seat, connected-app access, operating-system permissions, or unrestricted device access. Local Codex permissions and behavior remain separate. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) for policy scope and the [Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) for compatibility requirements.166Review seats, connected-app access, operating-system permissions, and Codex

167 167Local access separately. Members can keep workspace access after you turn off

168Turning off Local computer access with Work Cloud interrupts currently running turns. Users can start a new turn in an existing cloud conversation. That turn automatically uses Work Cloud without access to local files. Turning off sync does not by itself remove the member's workspace access.168local computer access. For the effect on running tasks, see the

169[rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup#if-you-need-to-turn-local-computer-access-off). For policy scope and compatibility requirements,

170see [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration) and the

171[Work admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq).

169 172 

170### Control Computer History access173### Control Computer History access

171 174 

6authentication. To combine gateway authentication with ChatGPT workspace sign-in, see6authentication. To combine gateway authentication with ChatGPT workspace sign-in, see

7[Sign in with ChatGPT through a gateway](https://learn.chatgpt.com/docs/enterprise/connect-to-a-gateway#enable-chatgpt-sign-in-recommended).7[Sign in with ChatGPT through a gateway](https://learn.chatgpt.com/docs/enterprise/connect-to-a-gateway#enable-chatgpt-sign-in-recommended).

8 8 

9<a id="connect-to-an-existing-gateway"></a>

10 

9To configure Codex on your own machine with values you were given, see11To configure Codex on your own machine with values you were given, see

10 [Configure the12 [Configure the

11 provider](https://learn.chatgpt.com/docs/enterprise/connect-to-a-gateway#configure-the-provider).13 provider](https://learn.chatgpt.com/docs/enterprise/connect-to-a-gateway#configure-the-provider).

12 Before choosing or rolling out a gateway, review the [gateway compatibility14 Before choosing or rolling out a gateway, review the [gateway compatibility

13 requirements](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility).15 requirements](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility).

14 16 

17<a id="prepare-a-gateway"></a>

18<a id="before-you-deploy"></a>

19 

15## Prerequisites20## Prerequisites

16 21 

17Before deploying Codex to developers, confirm that you have:22Before deploying Codex to developers, confirm that you have:

40 45 

41A health endpoint, `/v1/models`, Chat Completions response, or one plain-text reply does not qualify the gateway. See [Gateway compatibility requirements](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility) for the detailed contract.46A health endpoint, `/v1/models`, Chat Completions response, or one plain-text reply does not qualify the gateway. See [Gateway compatibility requirements](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility) for the detailed contract.

42 47 

48<a id="architecture"></a>

49 

43Need an implementation starting point? The [Codex deployment guidance repository](https://github.com/openai-on-aws/guidance-codex/tree/adbc00f353effbf0252e667ba41eb89c99324c8f) includes worked setups for different LLM gateway products. Use it as a reference after confirming your gateway meets the requirements above.50Need an implementation starting point? The [Codex deployment guidance repository](https://github.com/openai-on-aws/guidance-codex/tree/adbc00f353effbf0252e667ba41eb89c99324c8f) includes worked setups for different LLM gateway products. Use it as a reference after confirming your gateway meets the requirements above.

44 51 

52<a id="deployment-checkpoints"></a>

53 

45## Roll out the gateway54## Roll out the gateway

46 55 

47To move from a deployed gateway to a verified developer experience, complete these five checkpoints in order:56To move from a deployed gateway to a verified developer experience, complete these five checkpoints in order:

524. [Distribute the configuration](#distribute-the-configuration).614. [Distribute the configuration](#distribute-the-configuration).

535. [Verify from a developer machine](#verify-and-operate-the-rollout).625. [Verify from a developer machine](#verify-and-operate-the-rollout).

54 63 

64<a id="choose-the-bedrock-route"></a>

65<a id="configure-a-runtime-model-route"></a>

66 

55## Choose model names and routes67## Choose model names and routes

56 68 

57Set Codex's `model` to the gateway's model name. Configure the gateway to route that name to the approved upstream model.69Set Codex's `model` to the gateway's model name. Configure the gateway to route that name to the approved upstream model.

61| A [built-in model name](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility#recognized-model-names) included in your Codex version | Set `model` in `config.toml` to this exact name. |73| A [built-in model name](https://learn.chatgpt.com/docs/enterprise/gateway-compatibility#recognized-model-names) included in your Codex version | Set `model` in `config.toml` to this exact name. |

62| A custom alias, such as `company-coding-model` | Supply a remote or local catalog containing the alias and the corresponding model's metadata. |74| A custom alias, such as `company-coding-model` | Supply a remote or local catalog containing the alias and the corresponding model's metadata. |

63 75 

76<a id="prepare-the-client-catalog"></a>

64<a id="supply-metadata-for-a-custom-alias"></a>77<a id="supply-metadata-for-a-custom-alias"></a>

65 78 

66### Use a model catalog for custom names79### Use a model catalog for custom names

130Model routing and tool authorization are separate parts of the rollout. Configure143Model routing and tool authorization are separate parts of the rollout. Configure

131MCP connections, plugin distribution, and their policies separately.144MCP connections, plugin distribution, and their policies separately.

132 145 

146<a id="issue-a-test-credential"></a>

133<a id="issue-developer-credentials"></a>147<a id="issue-developer-credentials"></a>

134 148 

135## Choose authentication149## Choose authentication

168 and test token retrieval and refresh before distribution.182 and test token retrieval and refresh before distribution.

1695. Tell developers how to renew their credentials and whom to contact for help.1835. Tell developers how to renew their credentials and whom to contact for help.

170 184 

185<a id="verify-responses-support"></a>

171<a id="test-the-client-and-gateway"></a>186<a id="test-the-client-and-gateway"></a>

172 187 

173## Test Codex through the gateway188## Test Codex through the gateway

308 323 

309Manual setup is not an enforcement channel. Project-local `.codex/config.toml` cannot override sensitive provider or authentication routing keys.324Manual setup is not an enforcement channel. Project-local `.codex/config.toml` cannot override sensitive provider or authentication routing keys.

310 325 

326<a id="verify-the-user-connection"></a>

311<a id="verify-and-operate-the-rollout"></a>327<a id="verify-and-operate-the-rollout"></a>

312 328 

313## Verify from a developer machine329## Verify from a developer machine

322 338 

323Expand access after the pilot passes on the clients and authentication combinations you support. Keep the tested configuration and results with your rollout instructions so you can repeat the checks after client, gateway, or policy updates.339Expand access after the pilot passes on the clients and authentication combinations you support. Keep the tested configuration and results with your rollout instructions so you can repeat the checks after client, gateway, or policy updates.

324 340 

341<a id="troubleshoot-the-connection"></a>

342 

325### Troubleshoot rollout failures343### Troubleshoot rollout failures

326 344 

327Use the issue to find the configuration, credential, or gateway layer that needs attention:345Use the issue to find the configuration, credential, or gateway layer that needs attention: