What does Codex --full-auto actually do? Approvals and sandbox explained

codex --full-auto reads like "do everything automatically", but what it actually grants is freedom inside the workspace. Writing outside the workspace and reaching the network remain restricted by the sandbox.

One thing to know up front: the documentation now marks --full-auto as deprecated and points to codex exec --sandbox workspace-write instead. The flag still works, and knowing what it maps to is what lets you replace it.

What it maps to

--full-auto is shorthand for two settings:

approval_policy = "on-request"
sandbox_mode = "workspace-write"

Setting	Value	Meaning
Sandbox	workspace-write	Read files, edit within the workspace, run routine local commands inside that boundary. Network access disabled by default
Approval policy	on-request	The default: approval is required for sandbox escalations and network access

The other sandbox modes are read-only, where Codex can read files and run commands inside a read-only sandbox, and danger-full-access, which removes all sandbox restrictions and approval requirements and is not recommended for untrusted code.

Approval policies are on-failure (approval only when operations fail), on-request (the default), and never (no approval prompts). The older untrusted value has been retired and now causes startup failures.

What runs and what stops

Operation	Under --full-auto
Reading and editing files in the workspace	Runs
Running commands in the workspace (tests, builds)	Runs
Writing outside the workspace (~/.ssh, for example)	Sandbox refuses
Network access (npm install, curl)	Disabled by default; escalation requires approval
Git commits (inside the workspace)	Runs
git push	Needs the network, so it triggers an approval request

When npm install fails for lack of network, approving the escalation lets it retry outside the sandbox. If answering that every time gets tedious, allow network access in config instead.

Pinning it in config.toml

approval_policy = "on-request"
sandbox_mode = "workspace-write"

[sandbox_workspace_write]
network_access = true

This gives the same behavior without the flag, with network access enabled. Enabling the network also makes outbound data transfer possible, so keep it to repositories you trust.

Where it fits

Situation	Verdict
Refactoring a repository with a solid test suite	Good fit; it can iterate until tests pass
Bulk-fixing lint errors	Good fit
Exploring an unfamiliar codebase	--sandbox read-only is safer
An environment holding production credentials	Avoid; the sandbox does not restrict reads
Fully automated CI runs	Consider -a never in a disposable environment

Switching mid-session

Running /approvals during a session manages approval settings interactively, so you can adjust the policy without restarting Codex. It suits starting in a read-only investigation and moving to implementation partway through.

For the config file layout in general, see The Codex config.toml file.

Summary

• --full-auto is shorthand for approval_policy = "on-request" and sandbox_mode = "workspace-write"
• The documentation marks it deprecated and points to codex exec --sandbox workspace-write
• Network access is off by default under workspace-write; enable it with network_access = true
• The sandbox does not restrict reads, so secrets belong outside the workspace
• Use read-only for investigation, and --full-auto semantics for repositories with tests you trust