# OpenAI Codex

> Guides to OpenAI Codex's sandbox modes, approval policies, command rules and hooks, and the safe defaults to set before it touches real systems.

Web page: https://vinescale.com/blog/tags/codex/

OpenAI Codex runs commands inside a sandbox with an approval policy you choose. These guides cover the sandbox modes, approval settings and hooks, and what each one does and doesn't protect.

- [Claude Code vs Codex: permissions and sandboxing compared](https://vinescale.com/blog/claude-code-vs-codex-safety.md) (2026-11-02): How Claude Code and OpenAI Codex handle approvals, allow and deny rules, sandboxing, hooks and team policy, side by side and checked against both vendors' docs.

## Browse by topic

- [Claude Code](https://vinescale.com/blog/tags/claude-code.md): Guides to running Anthropic's Claude Code safely near production: permission rules, PreToolUse hooks, the Bash sandbox, settings and guardrails.
- [Cursor](https://vinescale.com/blog/tags/cursor.md): Guides to keeping Cursor's agent from running risky commands against real systems: run modes, allowlists, hooks, the sandbox and team settings.
- [Hooks](https://vinescale.com/blog/tags/hooks.md): Using coding agent hooks to check, warn about or block an action before it runs: working hook scripts, how each agent reads their output, and their limits.
- [Permissions](https://vinescale.com/blog/tags/permissions.md): Allow and deny rules, approval modes and credentials for coding agents: what an agent may do without asking, what it must ask about, and what never.
- [Databases](https://vinescale.com/blog/tags/databases.md): Protecting production databases from destructive queries and unsafe migrations by AI coding agents: read-only roles, safe migrations and separate credentials.
- [Infrastructure](https://vinescale.com/blog/tags/infrastructure.md): Keeping AI agents from deleting or changing cloud infrastructure, Terraform state and Kubernetes resources, on the agent's side and in the tools.
- [Incidents](https://vinescale.com/blog/tags/incidents.md): Publicly reported incidents where AI coding agents deleted databases, files or infrastructure, what each agent did, and the safeguard that would have helped.
- [Guardrails](https://vinescale.com/blog/tags/guardrails.md): How to put safety checks between an AI coding agent and the systems it can change: instructions, permission rules, hooks, sandboxes and credentials.