Approval policy

How an approval policy works

An approval policy gives each step of an AI agent one of three results. The control software applies the result before the step runs.

Result	What occurs	Example
Run	The step runs with no prompt	Codex edits a file in the workspace
Ask	The agent stops until a person says yes or no	Codex wants network access
Refuse	The step does not run	A Claude Code deny rule matches the command

The approval policy works with a sandbox. OpenAI says the sandbox “defines technical boundaries”. The approval policy “decides when the agent must stop and ask”.

Why an approval policy is necessary

An approval policy puts a person in front of the steps that can cause damage. OWASP advises human in the loop control “to require a human to approve high-impact actions”. This is one control against excessive agency.

In Claude Code, the control software applies the permission rules. Anthropic says: “Permission rules are enforced by Claude Code, not by the model.”

In practice

The same control has two shapes in two AI agents for code.

	OpenAI Codex	Claude Code
Name	approval_policy	permission modes and rules
Values (examples)	on-request, never, granular	default, acceptEdits, plan, auto, dontAsk, bypassPermissions
Rules	granular categories of prompts	allow, ask and deny rules, checked in the sequence deny, ask, allow
No prompts	never	bypassPermissions
Who can approve	the user, or an automatic reviewer	the user, or the classifier of auto mode

On 25 October 2026, the OpenAI documentation says Codex does not accept the value untrusted at this time.

Defaults in Codex, from the OpenAI documentation:

• No network access, and writes only in the active workspace.
• Codex asks before it edits files out of the workspace or runs commands that need the network.
• A destructive app or MCP tool call always asks when the tool marks itself as destructive.
• For a folder with version control, OpenAI recommends workspace write with on-request approvals.

Controls for an administrator in Claude Code:

• Set permissions.disableBypassPermissionsMode to "disable" to stop the mode with no prompts.
• Set permissions.disableAutoMode to "disable" to stop auto mode.
• Put the two in managed settings. Users cannot override managed settings.

A deny rule in Claude Code always wins. An allow rule cannot make a hole in a deny rule.

Trade-offs

Each selection moves the risk to a different area.

1. Ask frequently. A person sees each step, but approval fatigue starts. In an Anthropic test with 1,053 paid professional testers, human review caught 13.6% of dangerous commands (August 2026).
2. Let a classifier approve. In the same test, auto mode caught 89%. On 52 real overeager actions, the classifier missed 17%. Anthropic says auto mode “is not a drop-in replacement for careful human review”.
3. Never ask. Work is fast, but only the sandbox stops damage. Anthropic says to use bypassPermissions only in isolated containers or virtual machines.

An approval policy controls the agent, not the systems that the agent uses. OWASP also advises authorization “in downstream systems”. The model does not decide. Use least privilege on each credential, and use the approval policy on top of it.

All numbers on this page come from the vendors of the products. No independent study measured them.

Questions and answers

What is the difference between an approval policy and a sandbox?

A sandbox sets the limits of an AI agent: files, folders and the network. An approval policy sets when the agent must stop and ask a person before it goes past those limits. OpenAI says the two are different controls that work together.

Is approval_policy never safe in Codex?

The value never removes the approval prompts. The sandbox continues to apply. With danger-full-access, the sandbox limits go too. OpenAI calls that pair full access. For bypassPermissions in Claude Code, Anthropic gives the same advice. Use it only in isolated containers or virtual machines.

Can a prompt injection change the approval policy of an agent?

Not in products that apply the policy in their control software. Anthropic says Claude Code enforces permission rules, not the model. Text in a prompt does not change what is allowed. An attacker can try to make an allowed step cause damage.