termdeck
Two dials, not one
A Codex mode sets an approval policy and a sandbox mode together. The sandbox is enforcement rather than etiquette: in a read-only sandbox a write fails even if an approval slipped through.
Codex CLI guide: permission modes
Codex CLI approval and sandbox modes
Codex does not have a single permission setting. Every mode is a pair: an approval policy that decides when you are asked, and a sandbox that decides what is physically reachable even when nobody asks. That is why Codex can offer a genuinely read-only mode and Claude cannot.
OpenAI
On Codex CLI
Read only
Approval policy on request, sandbox read only. Codex can look at anything in the workspace and change none of it.
Plan
The read-only sandbox plus Codex native plan mode. The model explores and emits a proposed plan rather than acting, and on approval the work re-runs in auto to implement it. This is a real Codex feature, not a client-side approximation.
Auto
Approval policy on request, sandbox workspace-write. Codex can change files inside the workspace and asks about anything beyond it. New chats start here.
Full access
Approval policy never, sandbox disabled. Nothing is asked and nothing is fenced off, including paths outside the workspace.
No accept edits
There is no Codex mode where file writes pass automatically but commands still ask. Claude and Grok both have one. A tool that shows you the option on Codex is showing you something that does not exist.
Compare
One vocabulary, three engines
| Claude Code | Codex CLI | Grok CLI | |
|---|---|---|---|
| Plan only | Plans, then waits for approval | Native plan mode, read-only sandbox | Not supported, behaves as read-only |
| Supervised | Asks before every action | Asks, and sandboxes to read-only | Refuses outright instead of asking |
| Accept edits | File edits pass, commands ask | Not offered | File edits pass, commands ask |
| Auto | A classifier reviews risky actions | Workspace-write sandbox, asks on request | Not offered |
| Full access | No prompts at all | No prompts, sandbox disabled | No prompts at all |
| Starts new chats in | Auto | Auto | Accept edits |
Termdeck drives all three from one console, so the differences above stop being three separate habits to remember.
FAQ
Codex CLI permission modes, answered
What is the difference between approval policy and sandbox in Codex?
The approval policy decides when you get asked. The sandbox decides what is reachable at all. A read-only sandbox blocks a write even if the approval policy would have allowed it, so the sandbox is the one that actually enforces.
Does Codex have a real plan mode?
Yes. Plan mode is a Codex collaboration mode requested at the start of a turn, so the model produces a proposed plan instead of acting. It needs a build of Codex that offers the experimental API, and it needs a specific model rather than an unresolved default.
Why is there no accept edits mode in Codex?
Codex modes are approval and sandbox pairs, and no pair produces the behaviour where writes pass silently but commands stop. The nearest option is auto, which sandboxes writes to the workspace and still asks about anything outside it.
What does workspace-write actually allow?
Changes inside the working directory. Anything outside it, including other parts of the filesystem, triggers a request rather than going through, which is what separates auto from full access.
Claude Code, Codex and Grok in one browser console