Codex approval_policy vs sandbox_mode: which pairs are safe (on-request + workspace-write, never + read-only)

That error text means a granular approval policy is in effect, whatever the UI shows. approval_policy takes one of three forms — on-request, never, or { granular = { ... } } — and the granular form decides, per category of prompt, whether it surfaces or is auto-rejected. The configuration reference documents five fields:

With sandbox_approval set to false, a sandbox escalation approval is rejected without prompting you — which is exactly what the error states. To get the prompt instead, put one of these in ~/.codex/config.toml:

# Surface every approval prompt (the documented choice for interactive runs)
approval_policy = "on-request"

# Pick which categories surface
[approval_policy.granular]
sandbox_approval = true
rules = true
mcp_elicitations = true
request_permissions = true
skill_approval = true

The docs also note that untrusted is unsupported and on-failure is deprecated, and to use on-request for interactive runs.

If your own config.toml sets no approval_policy and you still see this, the value is arriving from somewhere else. The reference documents managed requirements, where an administrator sets "Allowed approval policies" in the Agent Security UI — an admin control, not a user setting. One more related key is approvals_reviewer, which decides "who reviews eligible approval prompts under on-request or granular approval policies" and defaults to user; it does not change sandboxing or actions already allowed inside the sandbox.

More detail: Codex approval policy and sandbox settings.

The message describes a deadlock: the action needs approval, but your approval policy is never, so there is no one to ask. With no way to prompt, it is rejected.

As of October 6, 2026, the configuration reference lists three forms for approval_policy:

The documentation puts it plainly:

untrusted is unsupported, and on-failure is deprecated; use on-request for interactive runs or never for non-interactive runs.

If you are sitting at the keyboard driving it, on-request is the intended value, not never:

approval_policy = "on-request"

To surface only some prompts, use granular. Categories set to true surface; categories set to false are auto-rejected.

[approval_policy.granular]
sandbox_approval = true      # sandbox escalation prompts
rules = true                 # prompts from execpolicy rules
mcp_elicitations = true      # MCP elicitations
request_permissions = true   # prompts from the request_permissions tool
skill_approval = true        # skill-script approval prompts

If what's failing is an action against an external service, mcp_elicitations is the relevant one: under never, an MCP server's request for confirmation is auto-rejected, so anything that needs a sign-in or a grant can't proceed.

One caveat about the report this came from: it describes the same action succeeding on the web and failing in the desktop app, and it carries a bug label. Why the effective approval policy differs between platforms could not be confirmed in the official documentation. If fixing the setting doesn't resolve it, follow that report.

For how approval policies and the sandbox combine, see Codex approval modes and sandbox.

Yes. The workspace-write sandbox blocks network access by default, so package downloads fail. With the on-failure approval policy Codex asks whether to rerun the command outside the sandbox; approve it and the install goes through. To stop being asked, allow the network in ~/.codex/config.toml:

sandbox_mode = "workspace-write"

[sandbox_workspace_write]
network_access = true

Allowing the network also allows data to leave the machine, so enable it only for repositories you trust. Research-only sessions can stay in read-only.