Codex permission profiles are actively evolving. Use either the current permission-profile system or legacy sandbox settings as documented; do not combine incompatible configuration styles.
1. Classify the repository
Decide whether the code is trusted, whether build scripts are understood, whether the task needs network access, and which directories really need writes.
2. Start with the restrictive default
Use read-only or tightly scoped workspace writes for investigation. Expand only when a concrete command or file operation is blocked.
3. Separate network from file access
A task may need package docs without needing arbitrary filesystem writes, or may need local edits without network. Grant these dimensions independently.
4. Review approvals as signals
When Codex asks for permission, read the exact command, path and reason. Repeated legitimate approvals may justify a narrow rule; surprising approvals are a warning to stop.
5. Re-test after changing config
Restart or verify the current session configuration and run a harmless boundary test. Do not assume editing a config file changed an already-running session.
Use the minimum permissions needed for this task. Before requesting any escalation, show the blocked command or path, explain why it is necessary, and propose the narrowest permission change that would unblock it.
Mixing legacy sandbox and new permission settings; enabling network for all tasks; approving shell commands without reading arguments; treating a familiar repository as permanently trusted.
Finish check
The task can complete, but unexpected paths, commands and network actions remain blocked or require review.