OpenAI Codex
Guides to OpenAI Codex's sandbox modes, approval policies, command rules and hooks, and the safe defaults to set before it touches real systems.
OpenAI Codex runs commands inside a sandbox with an approval policy you choose. These guides cover the sandbox modes, approval settings and hooks, and what each one does and doesn't protect.
-
Claude Code vs Codex: permissions and sandboxing compared
How Claude Code and OpenAI Codex handle approvals, allow and deny rules, sandboxing, hooks and team policy, side by side and checked against both vendors' docs.
Browse by topic
- Claude Code: Guides to running Anthropic's Claude Code safely near production: permission rules, PreToolUse hooks, the Bash sandbox, settings and guardrails.
- Cursor: Guides to keeping Cursor's agent from running risky commands against real systems: run modes, allowlists, hooks, the sandbox and team settings.
- Hooks: Using coding agent hooks to check, warn about or block an action before it runs: working hook scripts, how each agent reads their output, and their limits.
- Permissions: Allow and deny rules, approval modes and credentials for coding agents: what an agent may do without asking, what it must ask about, and what never.
- Databases: Protecting production databases from destructive queries and unsafe migrations by AI coding agents: read-only roles, safe migrations and separate credentials.
- Infrastructure: Keeping AI agents from deleting or changing cloud infrastructure, Terraform state and Kubernetes resources, on the agent's side and in the tools.
- Incidents: Publicly reported incidents where AI coding agents deleted databases, files or infrastructure, what each agent did, and the safeguard that would have helped.
- Guardrails: How to put safety checks between an AI coding agent and the systems it can change: instructions, permission rules, hooks, sandboxes and credentials.