An AI coding agent follows a repository’s rules only as far as the runtime enforces them. The practical approach has two halves. First, give the agent repository-specific context and a threat model so it understands what this codebase expects and where the risks are. Second, enforce boundaries outside the model’s own text, using a sandbox, an approval policy, network policy and scoped credentials, and record each consequential decision so a reviewer can later reconstruct what happened and why. The guidance below comes from OpenAI’s documentation of Codex and its agent tooling. Other coding agents may expose different controls, so check each product’s own settings before assuming any of these features exist.
Start with the repository’s own rules, then stop treating them as a fence
OpenAI’s description of the Codex agent loop explains that instructions are assembled from several inputs, including repository-local instruction files such as AGENTS.md, which can be found along the project path (OpenAI, “Unrolling the Codex agent loop”). Put to practical use, this is how you tell the agent which build and test commands to run, which directories are sensitive, and which conventions matter for this codebase. That context makes the agent’s work more relevant to your repository.
As an Amazon Associate I earn from qualifying purchases.
Instructions shape behavior but do not enforce it. A line in a markdown file cannot stop a file write or an outbound connection. Also, the file discovery behavior is described for Codex specifically, so do not assume another product reads the same files in the same order.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Sandboxing and approval policy do different jobs
OpenAI describes sandboxing and approvals as complementary controls (OpenAI, “Running Codex safely at OpenAI,” published May 8, 2026). The sandbox defines the technical limits of execution, such as which files can be written and whether network access is available. The approval policy determines when the agent must stop and ask before acting beyond those limits. Confusing the two is the most common design error: an approval prompt does not restrict what a process can reach, and a sandbox does not decide when a human should be consulted.
#1 Best Overall
| Control | Question it answers | What OpenAI’s guidance says it covers | What it does not do |
|---|---|---|---|
Repository instructions (AGENTS.md) |
What does this codebase expect? | Supplies task context drawn from local instruction files | Does not enforce anything on its own |
| Sandbox | What can the agent technically touch? | Sets execution boundaries such as file writes and network access | Does not decide when a human must be asked |
| Approval policy | When must the agent pause for review? | Determines when the agent must ask before acting beyond its allowed boundary | Does not limit what the environment can reach if an action is approved |
| Managed configuration | Are the same requirements applied consistently? | Can set consistent requirements across deployments | Specific scope and enforcement details not stated in the source |
| Network policy | Which destinations can the agent reach? | Can allow expected destinations and block or escalate unfamiliar ones | Coverage depends on how your environment routes traffic; verify in your setup |
Place checks at consequential tool boundaries
OpenAI’s guardrails guidance for agent applications recommends a pattern that applies well to coding agents. It is presented in the context of authorized cybersecurity workflows, so treat it as a model to adapt rather than a blanket rule for every tool call (OpenAI API documentation, “Guardrails and human review”). The guidance describes four behaviors:
- Check each proposed target and action against the scope that was authorized for the task.
- Pause ambiguous or high-risk actions and require explicit approval before they run.
- Record the approval decision and the execution outcome.
- Fail closed: if review times out or the reviewer is unavailable, the action does not proceed.
In practice, the boundaries that matter most are the ones where an action can affect files outside the working tree, read or use credentials, make outbound network calls, or change production systems. A fail-closed rule means an overnight agent run that needs a sign-off on a deployment step waits, rather than continuing because nobody answered the approval request.
Limit what the agent can reach
OpenAI’s sandbox security documentation states that generated code can access whatever files, credentials and network paths are provided to its execution environment. It recommends isolated compute, restricted network access, and keeping long-lived or broader application credentials outside the execution environment where possible (OpenAI API documentation, “Sandbox security”). Turning that guidance into a configuration checklist:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Mount only the repository checkout the task needs, not a home directory or a shared workspace root.
- Give the agent narrowly scoped, short-lived credentials for the task rather than an organization-wide key.
- Keep deployment credentials and production secrets out of the execution environment entirely.
- Allow a named list of network destinations, such as your package registry and internal code host, and route everything else to block or escalation.
- Run the agent on isolated compute that is separate from production hosts.
These steps follow from the guidance’s least-privilege principle. OpenAI’s documentation does not prescribe specific mount paths or token lifetimes, so set those according to your own threat model.
Make decisions reconstructable with agent-aware logs
Ordinary system logs record that a process ran. They rarely record why an agent chose an action or whether a human approved it. OpenAI states that Codex can export OpenTelemetry events, and it lists the following categories among them (OpenAI, “Running Codex safely at OpenAI,” published May 8, 2026):
- User prompts
- Tool approval decisions
- Tool execution results
- MCP server usage
- Network proxy allow and deny events
OpenAI describes these events as something that can be centralized in SIEM and compliance logging systems. Those five categories cover the path from request to action: what was asked, what the agent was permitted to do, what it did, which external services it used, and which network destinations were allowed or refused. Retention periods, default event settings and export format depend on your deployment and are not specified in the source, so confirm them in your configuration before relying on the log for an audit.
Rank #4
Keep human review in the remediation path
For vulnerability work, Codex Security shows how repository-aware analysis and human review can fit together. According to OpenAI’s Help Center, it builds a threat model tailored to the codebase, identifying attacker entry points, trust boundaries, sensitive data and important code paths. Teams can inspect and edit that model so it reflects their deployment assumptions. The product validates potential vulnerabilities in an isolated environment and proposes fixes that are presented for human review rather than applied automatically (OpenAI Help Center, “Codex Security”).
Feature access, preview status and commercial terms for this product change over time. Check the current Help Center article before planning a rollout or budgeting for it.
Best Value
Compare approaches on six axes
When you evaluate any coding agent setup, the following questions separate a controlled deployment from a permissive one.
| Axis | Question to ask | What a controlled setup shows |
|---|---|---|
| Repository context | Can maintainers supply local instructions and adjust assumptions for this codebase? | Instruction files are versioned with the repo, and the threat model can be edited |
| Enforcement boundary | Are filesystem, network, identity and project permissions constrained separately? | Each boundary is set independently and does not depend on the model’s compliance |
| Approval behavior | Which actions run automatically, which are blocked, and which wait for review? | Risky actions are held, and an unavailable reviewer causes a denial |
| Decision evidence | Do logs retain tool activity, approvals, outcomes and policy decisions in a queryable form? | Events can be exported and centralized for review |
| Human review | Do validated findings and patches enter the team’s normal review path? | Proposed fixes go through the same review process as other code changes |
| Credential and network exposure | What can the agent reach, and are credentials scoped and kept outside its execution context? | Credentials are task-scoped, and network destinations are an explicit allow list |
Where this guidance stops
OpenAI’s material describes how Codex and its agent tooling are designed to work. It does not provide measured failure rates or benchmark results comparing controls, so the case for any particular configuration rests on your own threat model and the logs your environment produces. The approaches above also depend on the product you run: the instruction files, approval options and telemetry categories named here belong to Codex and OpenAI’s agent platform, and other products may differ.
The Bottom Line
Use repository instructions to make the agent relevant to your codebase, but make the sandbox, approval policy, network policy and credential scoping the controls that actually limit it. Then export agent-aware events to your logging system so each approval and network decision can be reviewed later.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
