Codex Auto-Review and the Approve for Me Mode Explained

OpenAI Codex auto review has a separate reviewer agent check boundary-crossing tool calls before they run, so far fewer of them stop and wait for you. In the ChatGPT desktop app, the mode is called Approve for me. The main Codex agent still runs inside the same sandbox with the same network and filesystem limits, and only the reviewer of eligible escalation requests changes.

As of October 2026, the OpenAI Help Center guide specifies that auto review safety checks are free and do not count toward usage limits when signed in with a ChatGPT account. OpenAI's developer docs still say automatic review "can add to Codex usage," so OpenAI's own pages disagree on cost.

How Codex Auto-Review Works

Codex auto review operates by intercepting boundary-crossing actions at the sandbox boundary and routing them to a secondary reviewer agent. The main Codex agent runs inside a restricted environment defined by standard filesystem and network controls. When the primary agent attempts an operation outside these baseline parameters, Codex generates an approval request and sends it to the reviewer agent rather than pausing for user input.

The reviewer agent inspects a compact transcript of the current session alongside the specific approval payload to determine whether the action conforms to safety rules. Hidden assistant reasoning is excluded from this evaluation transcript. The Auto-review documentation confirms that this mechanism represents a reviewer swap rather than an expansion of underlying file paths or network permissions.

If the reviewer approves the request, Codex can continue. If the reviewer denies the action, Codex receives an instruction forbidding workarounds or policy circumvention, prompting it to either attempt a safer implementation or pause for direct human input. Routine operations that stay strictly within configured sandbox boundaries execute normally and never trigger the review pipeline.

Comparison of Three Permission Modes and Sandbox Boundaries

In the ChatGPT desktop app, the permissions menu can include Ask for approval, Approve for me, Full access, and named or custom permissions profiles. According to the Codex permission modes documentation, developers can configure the workspace boundary to require manual confirmation, automated review, or unrestricted execution.

Prior to auto review, users faced a choice between high-friction manual approvals and full access execution, as detailed in an OpenAI Alignment Research publication. The post says that friction pushed some users to Full Access or to overly permissive prefix rules, citing "a sizable minority of users who allow all commands that begin with the word python." Others approved commands "without fully understanding the consequences." Auto review introduces an intermediate option that preserves the default sandbox perimeter while delegating routine escalation checks to an automated agent.

• Ask for approval (Default Mode): Configures sandbox_mode = "workspace-write", approval_policy = "on-request", and network_access = false, routing all boundary escalations directly to the user via approvals_reviewer = "user".
• Approve for me (Auto-Review Mode): Retains the standard workspace write sandbox and on-request approval policy, but assigns approvals_reviewer = "auto_review" so eligible escalation requests are evaluated by the reviewer model.
• Full access (Unrestricted Mode): Combines sandbox_mode = "danger-full-access" with approval_policy = "never", bypassing all sandbox boundaries and approval prompts entirely.

Trigger Conditions and Safety Boundary Interceptions

Auto review triggers only when the primary agent requests an operation that exceeds standard sandbox boundaries. The Auto-review reference lists four triggers. Shell or exec tool calls that request escalated sandbox permissions trigger a review, and so do network requests blocked by the current sandbox or policy. File edits outside the allowed writable roots also trigger one, as do Model Context Protocol (MCP) or app tool calls that require approval. Actions already authorized within baseline workspace boundaries execute without review.

The reviewer policy is structured across risk tiers to enforce security constraints during automated sessions. Low-risk and medium-risk operations can proceed when policy permits, while critical-risk operations are denied automatically. High-risk actions need enough user authorization and no matching deny rule. If the review prompt cannot be built, the review session fails, or the reply cannot be parsed, the request fails closed and the action does not run.

The Auto-review page lists four kinds of action the reviewer is designed to block. It names sending private data or credentials to untrusted destinations and probing for tokens, cookies, or session material. It also names broad or persistent security weakening, and destructive actions with significant risk of irreversible damage. However, app-level approvals for Computer Use continue to surface directly to the user and are not handled by auto review.

Step-by-Step Configuration and Disabling Instructions

You can turn Codex auto review on or off in the desktop app, in the command-line interface (CLI), or in config.toml. In the desktop application, users can select Approve for me directly from the permissions picker located below the message composer. Alternatively, the OpenAI Help Center states that users can navigate to Settings, select Permissions, and toggle Auto-review.

Terminal users can configure permissions interactively or via configuration files. Running the command /permissions within the Command-Line Interface opens the interactive permissions picker. In persistent environments, users can edit config.toml by specifying approval_policy = "on-request" alongside approvals_reviewer = "auto_review", noting that altering the approval policy alone does not set the reviewer.

To turn auto review off in config.toml, set approvals_reviewer = "user", which restores the default of routing every escalation prompt to you. In the desktop app, switch the permissions control back to Ask for approval. The Codex troubleshooting documentation notes that if the option is missing, users should verify desktop application updates, check whether features.guardian_approval = false is active, or review administrative constraints in managed workspaces.

What Happens When the Reviewer Denies an Action

When the reviewer denies an action, Codex tells the main agent to continue only with a materially safer alternative, and otherwise to stop and ask the user. Codex tells the main agent not to pursue the same outcome through a workaround, indirect execution, or policy circumvention. OpenAI's alignment post says that in its internal deployment, Codex continues after a denial and finds an acceptable solution in more than half of cases.

Auto review also has a circuit breaker. It interrupts the turn after 3 consecutive denials, or after 10 denials within a rolling window of the last 50 reviews in the same turn.

In the open-source Text User Interface (TUI), users can manually override specific rejections using the /approve command. This opens the Auto-review Denials interface, which stores up to 10 recent rejections per task, allowing the developer to select a single action for retry. The retried action is resubmitted through the auto review pipeline rather than bypassing evaluation rules.

Documented Safety Recall and Red-Teaming Boundaries

Internal evaluation metrics show that auto review decreases manual approval interruptions while maintaining high recall on adversarial inputs. According to research published by OpenAI alignment researchers, including Maja Trębacz and Sam Arnesen, sessions running in auto review mode stop for human confirmation roughly 200 times less often than manual sessions. On escalated actions, auto review had a 99.1 percent auto-approval rate and a 99.93 percent effective approval rate across all task actions.

Safety evaluations recorded a 99.3 percent recall rate against prompt injection attempts, a 96.1 percent recall rate on the MonitoringBench Hard benchmark, and a 90.3 percent recall rate against overeagerness errors. In one snapshot, 720 out-of-sandbox actions would have interrupted the user. Auto review rejected 7 of them: 4 continued via a safer path and 3 stopped for user input. As of OpenAI's April 30, 2026 post, a majority of Codex Desktop token usage within OpenAI came from auto review mode.

Despite these benchmark figures, OpenAI emphasizes that auto review does not provide deterministic security guarantees and does not defend against model scheming. During automated and human red-teaming, OpenAI found cases where auto review could be misled into approving commands without user approval. OpenAI's docs say it should sit alongside good sandbox design, monitoring, and organization-specific policy instead of replacing them.

Cost and Plan Eligibility for Codex Auto-Review

Whether auto review costs anything is contested across OpenAI's own pages. The OpenAI Help Center says that when you're signed in with a ChatGPT account, auto-review safety checks "are free and don't count toward your plan's usage limits," while other Codex activity stays subject to plan limits and charges. The Codex agent approvals security documentation still says "Automatic review uses extra model calls, so it can add to Codex usage." The help center statement is the newer, consumer-facing one, and its free terms cover ChatGPT sign-ins only. OpenAI has not published a date for the change, whether it is permanent, or whether API-key sign-ins get the same terms.

Plan eligibility presents conflicting published information across official OpenAI pages. The help center says "Codex is included across ChatGPT plans, including Free and Go," and its free-review statement covers any ChatGPT sign-in. The feature table in the Codex pricing documentation lists "Auto-review for approval requests" only for Plus ($20 per month), Pro (from $100 per month), Business, Enterprise, and API, with no Free ($0) or Go ($8 per month) column. Auto review on Free and Go is not confirmed.

OpenAI's docs say auto review "is not a deterministic security guarantee," so it does not fit work that needs one. OpenAI's own guidance is "For most work, start with Ask for approval," and its docs warn the reviewer "can still make mistakes, especially in adversarial or unusual contexts." That picture would change if OpenAI began counting reviews against ChatGPT plan limits, or published the current reviewer model and terms for API-key sign-ins. Plan prices and usage caps for the rest of Codex are covered in OpenAI Codex pricing and OpenAI Codex limits.