Introduction
OpenAI Codex Desktop implements a dual‑dimension permission architecture, governed independently by sandbox_mode and approval_policy. A very common developer pain point persists: users enable the danger‑full‑access sandbox mode (labelled “Full Access” inside desktop UI), yet the tool still pops‑up manual approval dialogues for agent operations. Most end‑users mistakenly treat Full Access as a single master toggle that disables all confirmation prompts, failing to understand sandbox constraints and approval policies operate as two separate control planes.
This article dissects five core sources of persistent approval pop‑ups, alongside one supplementary configuration‑conflict scenario. It distinguishes expected design behaviours from confirmed software bugs, presents three practical resolution workflows including two‑step UI setup, permanent config.toml configuration, and one‑shot command‑line bypass. It also explains why auto‑review is the preferred production‑grade alternative to fully disabling approval checks. When building multi‑agent stacks that combine local Codex deployments with remote LLM endpoints, developers can leverage Treerouter for unified access governance across heterogeneous model services.
Core one‑sentence takeaway: danger‑full‑access controls what actions the agent is technically permitted to execute; approval_policy governs when Codex must pause and request human confirmation. Both knobs must be adjusted together to eliminate manual prompt interruptions.
1. Two Independent Permission Dimensions: Sandbox Mode and Approval Policy
Official documentation explicitly draws the boundary: “sandbox_mode sets what the agent can technically do … and approval_policy sets when it must stop and ask you.”
| Dimension | Responsibility | Configuration Key | Desktop UI Entry |
|---|---|---|---|
Sandbox (sandbox_mode) |
Defines filesystem boundaries and network access permissions | sandbox_mode |
Permission dropdown sandbox selector |
Approval (approval_policy) |
Defines conditions for human‑review blocking prompts | approval_policy |
Separate “Approve for me” toggle beside Full‑Access option |
Sandbox mode three tiers
| Sandbox Mode | File‑system Behaviour | Network Access | Typical Use‑case |
|---|---|---|---|
read‑only |
Read‑only, no write operations | Disabled | Audit untrusted code repositories |
workspace‑write (default) |
Write permission limited to active workspace directory | Disabled by default | Daily development workflows |
danger‑full‑access |
No filesystem restrictions | Unrestricted network calls | Isolated container‑only usage |
Approval policy three tiers
| Approval Policy | Runtime Behaviour | Recommended Scenario |
|---|---|---|
on‑request (default) |
Pauses execution and triggers prompt whenever sandbox boundaries are crossed | General daily development |
untrusted |
Request manual confirmation for every state‑changing operation | High‑security threat‑mitigation scenarios |
never |
Suppress all interactive pop‑ups; rely purely on sandbox‑level restrictions | CI/CD automated agent pipelines |
A useful analogy: sandbox mode corresponds to removing speed‑limit barriers for a vehicle, while approval policy functions as repeated confirmation prompts before every departure. Removing speed limits does not turn off reminder prompts.
2. Five Root Causes for Persistent Approval Pop‑ups
Cause 1: Sandbox setting updated, approval policy remains unchanged (Most Frequent)
More than two‑thirds of reported support cases stem from this misconfiguration. When users select “Full Access” inside Codex Desktop UI, only sandbox_mode switches to danger‑full‑access. The approval_policy value stays at default on‑request.
Even with unrestricted sandbox permissions, Codex will still halt execution and show approval prompts under these triggers:
- Resource access crossing implicit security boundaries
- Execution of pre‑tagged high‑risk commands
- Initiating outbound network requests
Although danger‑full‑access removes filesystem restrictions, network requests and certain tool invocations still trigger approval flows.
Resolution: Modify both configuration parameters simultaneously.
- Desktop UI workflow: select Full‑Access permission profile, and enable the “Approve for me” toggle on the same settings panel. This sets
approval_policy = "never". - Permanent
config.tomlsnippet:
sandbox_mode = "danger‑full‑access"
approval_policy = "never"
- One‑shot command‑line invocation:
codex --dangerously‑bypass‑approvals‑and‑sandbox "your task description"
# alias shorthand: --yolo
The --yolo flag internally disables both sandbox isolation and approval prompts, not merely one of them.
Cause 2: Desktop‑UI “Full Access” requires two‑step unlock
Many developers encounter confusion: the Full‑Access dropdown item is hidden by default and does not activate immediately after enabling the backend switch. Complete operating procedure:
- Navigate to
Settings → General → Permissions, toggle on “Full access” option. This action only adds the option into permission dropdown list; it does not activate the mode. - Return to conversation view, open permission dropdown menu and manually choose “Full access”.
- Verify that “Approve for me” toggle is also activated.
Numerous GitHub and Reddit community reports (May 2026) document users expecting step‑one alone to take immediate effect.
Cause 3: Hard‑coded approval triggers for destructive tool invocations
Even when --yolo complete bypass mode is active, specific operations still generate mandatory approval pop‑ups. These are intentional design constraints rather than software defects.
Triggering conditions cover:
- MCP / App tool calls annotated with
destructive annotationmetadata - High‑risk irreversible operations: data deletion, forced git hard‑reset, outbound email delivery, public publishing workflows
Official documentation note: “app/MCP tool calls with destructive annotations still require approval unless the tool advertises a read annotation.”
Sandbox‑layer configuration cannot override destructive‑annotation checks. For occasional execution, click “Allow once” to proceed. For repeated workflows, contact tool maintainers to lower destructive annotation severity inside tool manifest definitions.
Cause 4: Confusing auto‑review status indicators for blocking approval dialogues
Codex Desktop renders two visually similar yet functionally distinct UI panels during agent runtime.
| Item | Trigger Condition | Blocks Agent Execution |
|---|---|---|
| Manual approval prompt | approval_policy runtime rule matches |
Yes, execution pauses waiting for user input |
| Auto‑review status indicator | approvals_reviewer = "auto‑review" |
No; purely informational display |
After enabling “Approve for me” (approvals_reviewer = "auto‑review"), the interface displays status tags such as Reviewing → Approved / Denied. These status labels do not halt agent execution. If you only observe these status badges without manual confirmation buttons, Codex agent continues running autonomously. Many developers misinterpret auto‑review status messages as blocking approval pop‑ups.
Cause 5: Permission state desync after application restart (Confirmed Bug)
GitHub issue #29054 documents a reproducible bug in Codex Desktop 2026‑06 release. After restarting Codex Desktop or reconnecting remote sessions:
- Graphical UI still visually displays “Full Access” status
- Actual runtime permission behaviour reverts to requiring manual approval prompts
- JSON log metadata correctly persists
approval_policy = "never"andsandbox_mode = "danger‑full‑access" - In‑memory runtime execution rules diverge from persisted configuration values
At time of writing, OpenAI has not published an official patch. Practical workarounds:
- Re‑select “Full Access” within permission dropdown after every restart to force refresh runtime permission state.
- Prefer goal‑oriented task triggering (
/goalcommand). Permission state maintains higher consistency across restarts for goal‑driven sessions. - Version mismatch between embedded CLI binary (0.133.0) and system‑wide standalone CLI binary also contributes to desync on Windows desktop builds.
Supplementary Cause: Mixed legacy and modern permission configuration conflict
Codex maintains two parallel permission configuration schemas inside config.toml. Mixing both schema groups causes partial settings to be silently ignored.
| Schema Set | Configuration Fields | Support Status |
|---|---|---|
| Legacy schema | sandbox_mode + approval_policy |
Long‑term CLI support |
| Modern schema | default_permissions + [permissions] |
Desktop‑recommended configuration |
Official documentation warning: “sandbox_mode and approval_policy are not both compatible with permission profiles. Configure either default_permissions and [permissions], or sandbox‑mode settings.”
If your config.toml contains entries from both systems, part of permission directives will be discarded. Troubleshooting step: inspect ~/.codex/config.toml, retain only one configuration schema and remove redundant fields.
3. Three Valid Approaches to Suppress Approval Pop‑ups
Method A: Desktop graphical‑interface setup (Recommended for beginners)
- Open
Settings → General → Permissions, enable Full‑access toggle to expose dropdown menu entry. - Return to conversation view, open permission selector and choose “Full access”.
- Within identical permission panel, turn on “Approve for me”. Remember these two switches operate independently.
Method B: Permanent configuration via config.toml
Write legacy‑schema persistent settings inside Codex configuration file:
sandbox_mode = "danger‑full‑access"
approval_policy = "never"
Changes persist across application restarts. Desktop‑UI runtime selections take priority over static file for active session; edit config.toml for permanent baseline behaviour.
Method C: One‑off command‑line runtime bypass
codex --dangerously‑bypass‑approvals‑and‑sandbox "describe your agent task"
This setting applies only for single invocation, without modifying persisted configuration files.
4. Security Warnings and Production‑Recommended Configuration
The combined setting danger‑full‑access + approval_policy = "never" represents the highest‑risk permission combination available for Codex.
- Sandbox isolation removes filesystem and network boundary restrictions
- Approval policy disables the final human‑confirmation safety gate
- Agent can read‑write arbitrary local paths and initiate unfiltered outbound network traffic
OpenAI security documentation explicitly marks this combination as high‑risk mode, only intended for isolated testing environments.
The balanced production‑grade baseline configuration is shown below:
sandbox_mode = "workspace‑write"
approval_policy = "on‑request"
approvals_reviewer = "auto‑review"
This configuration retains workspace‑level sandbox boundaries, replaces manual click‑through approvals with AI‑driven auto‑review judgement, minimises workflow interruptions while preserving core security guardrails.
For teams running multi‑model agent workloads across mixed local Codex and remote LLM endpoints, you can centralise API credential management and traffic routing via Treerouter, avoiding scattered secret copies inside local configuration files. Additional granular access control can be achieved by writable_roots path whitelisting and rule‑based filtering.
5. Frequently Asked Troubleshooting
Q: Are desktop “Full Access” and CLI --dangerously‑bypass‑approvals‑and‑sandbox functionally identical?
Not fully equivalent. Desktop Full‑Access only adjusts sandbox mode. You must manually activate “Approve for me” to mirror full CLI bypass behaviour. The shorthand --yolo flag applies both sandbox and approval‑policy overrides simultaneously.
Q: Are destructive‑tool pop‑ups software bugs? No, these are intentional hard‑coded safeguards defined in tool‑layer metadata. Neither sandbox‑mode nor approval‑policy parameters can bypass destructive‑annotation validations.
Q: How do I visually distinguish auto‑review status versus manual‑blocking prompts?
Manual blocking prompts render Accept / Deny / Abort interactive buttons and pause agent execution. Auto‑review only displays status text tags such as Reviewing, Approved, Denied without blocking runtime progress.
Q: How to handle permission desync after restart?
This is confirmed tracked bug #29054 without official hotfix. Manual re‑select Full‑Access permission after restart refreshes runtime state. /goal driven task sessions improve permission stability.
Q: Which configuration takes higher priority, desktop UI or config.toml?
Desktop runtime selections override static config.toml values for active session. To make permanent baseline changes, modify config.toml.
Conclusion
The most common source of unexpected Codex approval prompts lies in its dual independent permission design: sandbox mode and approval‑policy are separate controls, frequently misunderstood as a single unified toggle. Additional triggers include multi‑step UI unlock workflows, hard‑coded destructive‑tool annotations, UI status‑indicator misinterpretation, confirmed restart‑state desync bugs, and mixed‑schema configuration conflicts.
Completely disabling all approval prompts creates substantial local‑system security exposure. Official guidance suggests adopting auto‑review workflow instead of full bypass. It keeps sandbox security boundaries intact while replacing repetitive manual clicks with AI‑powered review judgements, balancing developer productivity and system safety. All guidance in this article is built against Codex Desktop 2026‑06‑08 release; permission subsystem continues evolving, cross‑reference official documentation for newer versions.
Learn more：https://treerouter.com
