A coding agent can inspect a repository without being allowed to change its files—but only when read-only access is enforced as a permission boundary, not merely requested in a prompt. In Codex, the read-only sandbox template says, “The sandbox only permits reading files.” Network access and approval behavior are separate settings, so read-only does not by itself mean offline or remove every permission prompt.
What read-only means—and what it does not
Read-only mode limits the agent’s ability to write to files within the scope enforced by its sandbox. It is useful for repository orientation, code review, architecture questions, and investigating likely causes of a bug when the agent needs to examine code but should not modify it.
As an Amazon Associate I earn from qualifying purchases.
The Codex read-only sandbox template describes its file behavior narrowly: “The sandbox only permits reading files.” It treats network access as a separate configuration value. That distinction matters: a file-write restriction does not establish whether the agent can access the internet, and network restrictions do not establish whether it can write files.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A request such as “please don’t edit anything” is an instruction to the agent, not an enforced boundary. OpenAI describes the sandbox as the technical execution boundary for where Codex can write, whether it can reach the network, and which paths remain protected. Approval policy governs when Codex must ask permission to cross that boundary. These controls are related, but they are not interchangeable. OpenAI’s explanation of Codex safety controls describes the distinction.
#1 Best Overall
Separate the controls when choosing a setup
| Control | What it governs | What to check |
|---|---|---|
| Filesystem sandbox | Whether the agent can write files and which paths are protected. | Confirm that writes are technically blocked for the repository and any other relevant paths. |
| Network access | Whether the agent can reach external network resources, and whether that access is controlled. | Check the network setting separately; read-only file access does not tell you whether network access is allowed. |
| Approval policy | When the agent must ask before attempting an action outside the sandbox boundary. | Understand which actions trigger approval and what the client or administrator permits. |
| Execution enforcement | Whether restrictions apply to commands and processes launched by the agent. | Check how the sandbox enforces controls for child processes, not only the main agent process. |
OpenAI’s Windows engineering account explains why enforcement details matter. It says restrictions should be enforced by the operating system and propagated to child processes. It also describes a network-suppression design based on environment and tool overrides that was advisory: some programs could ignore those controls or connect directly. That account concerns a particular engineering implementation; it does not establish that every current sandbox has the same limitation. It does show why network controls should be evaluated independently and why a prompt or wrapper alone may not be a dependable boundary. Read OpenAI’s Windows sandbox engineering account.
When a read-only configuration is a good fit
Use a restrictive read-only setup when the task is to understand existing code rather than produce changes. Examples include asking where a feature is implemented, tracing a call path, reviewing a proposed design against the repository, or identifying files that may explain a reported bug.
- Give the agent access to the repository content it needs to inspect.
- Use an enforced filesystem boundary that prevents writes, rather than relying only on a natural-language instruction.
- Decide separately whether the task needs external network access.
- Choose an approval policy that reflects when you want the agent to pause and request permission.
The Codex Help Center names sandbox_mode = "read-only" with approval_policy = "on-request" as a restrictive configuration option when correcting a configuration error. Treat this as a starting point to check against the client you use and any managed policy in force; the Help Center does not establish identical behavior across all clients, administrator settings, or future versions. See the Codex Help Center configuration guidance.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →When an isolated workspace is more useful
Some jobs need more than passive inspection: the agent may need to run tests, use packages, create artifacts, or preserve work so a workflow can resume. In those cases, a sandboxed workspace can provide files, a shell, packages, mounted data, exposed ports, and controlled external access without giving the agent unrestricted access to the developer’s environment.
OpenAI’s Agents SDK guide recommends sandbox environments when a task depends on workspace work or needs commands, files, generated artifacts, or resumable state. Scope mounted data to the inputs the agent should use, and inspect generated artifacts before relying on them. A workspace sandbox is not automatically read-only: its actual write and network permissions depend on how it is configured. Review the Agents SDK sandbox guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to evaluate a read-only agent setup
Before trusting a setup for repository inspection, check the boundary rather than inferring protections from the product label alone:
Rank #4
- Write scope: Which files and paths can the agent read, and which are protected from writes?
- Network scope: Is external access blocked, allowed, or mediated? Is that control enforced for programs the agent launches?
- Approval behavior: Which actions require a request, and what happens if permission is denied?
- Process coverage: Do restrictions apply to shell commands and child processes as well as the agent itself?
- Workspace scope: Which files are mounted or exposed, and how will generated outputs be reviewed?
- Configuration context: Which client version and administrator-managed policies determine the actual behavior?
These checks distinguish a genuinely constrained inspection environment from one that merely asks an agent to behave carefully. Product capabilities and managed settings can change, so confirm the current documentation for the client and environment you will use.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
