config-advanced.md Codex Docs, 2026-04-22 18:29 UTC → 2026-04-24 12:28 UTC

230 230 

231You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.231You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.

232 232 

233```233Set `approvals_reviewer = "auto_review"` to route eligible interactive approval

234requests through automatic review. This changes the reviewer, not the sandbox

235boundary.

236 

237Use `[auto_review].policy` for local reviewer policy instructions. Managed

238`guardian_policy_config` takes precedence.

239 

240```toml

234approval_policy = "untrusted" # Other options: on-request, never, or { granular = { ... } }241approval_policy = "untrusted" # Other options: on-request, never, or { granular = { ... } }

242approvals_reviewer = "user" # Or "auto_review" for automatic review

235sandbox_mode = "workspace-write"243sandbox_mode = "workspace-write"

236allow_login_shell = false # Optional hardening: disallow login shells for shell tools244allow_login_shell = false # Optional hardening: disallow login shells for shell tools

237 245 

249exclude_slash_tmp = false # Allow /tmp257exclude_slash_tmp = false # Allow /tmp

250writable_roots = ["/Users/YOU/.pyenv/shims"]258writable_roots = ["/Users/YOU/.pyenv/shims"]

251network_access = false # Opt in to outbound network259network_access = false # Opt in to outbound network

260 

261[auto_review]

262policy = """

263Use your organization's automatic review policy.

264"""

252```265```

253 266 

254Need the complete key list (including profile-scoped overrides and requirements constraints)? See [Configuration Reference](https://developers.openai.com/codex/config-reference) and [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).267Need the complete key list (including profile-scoped overrides and requirements constraints)? See [Configuration Reference](https://developers.openai.com/codex/config-reference) and [Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration).