config-basic.md Codex Docs, 2026-04-29 12:40 UTC → 2026-04-30 18:36 UTC

69 69 

70For mode-by-mode behavior (including protected `.git`/`.codex` paths and network defaults), see [Sandbox and approvals](https://developers.openai.com/codex/agent-approvals-security#sandbox-and-approvals), [Protected paths in writable roots](https://developers.openai.com/codex/agent-approvals-security#protected-paths-in-writable-roots), and [Network access](https://developers.openai.com/codex/agent-approvals-security#network-access).70For mode-by-mode behavior (including protected `.git`/`.codex` paths and network defaults), see [Sandbox and approvals](https://developers.openai.com/codex/agent-approvals-security#sandbox-and-approvals), [Protected paths in writable roots](https://developers.openai.com/codex/agent-approvals-security#protected-paths-in-writable-roots), and [Network access](https://developers.openai.com/codex/agent-approvals-security#network-access).

71 71 

72#### Permission profiles

73 

74Use a named permission profile when you want one reusable filesystem or network policy across sessions:

75 

76```toml

77default_permissions = ":workspace"

78```

79 

80Built-in profiles include `:read-only`, `:workspace`, and `:danger-no-sandbox`. For custom filesystem or network rules, define `[permissions.<name>]` tables and set `default_permissions` to that name.

81 

72#### Windows sandbox mode82#### Windows sandbox mode

73 83 

74When running Codex natively on Windows, set the native sandbox mode to `elevated` in the `windows` table. Use `unelevated` only if you don't have administrator permissions or if elevated setup fails.84When running Codex natively on Windows, set the native sandbox mode to `elevated` in the `windows` table. Use `unelevated` only if you don't have administrator permissions or if elevated setup fails.

111 121 

112You can override this later in an active session with `/personality` or per thread/turn when using the app-server APIs.122You can override this later in an active session with `/personality` or per thread/turn when using the app-server APIs.

113 123 

124#### TUI keymap

125 

126Customize terminal shortcuts under `tui.keymap`. Context-specific bindings override `tui.keymap.global`, and an empty list unbinds the action.

127 

128```toml

129[tui.keymap.global]

130open_transcript = "ctrl-t"

131 

132[tui.keymap.composer]

133submit = ["enter", "ctrl-m"]

134```

135 

114#### Command environment136#### Command environment

115 137 

116Control which environment variables Codex forwards to spawned commands.138Control which environment variables Codex forwards to spawned commands.