8 8
9By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.9By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.
10 10
11For a high-level explanation of how sandboxing works across the Codex app, IDE
12extension, and CLI, see [Sandboxing](https://developers.openai.com/codex/concepts/sandboxing).
13
11## Sandbox and approvals14## Sandbox and approvals
12 15
13Codex security controls come from two layers that work together:16Codex security controls come from two layers that work together: