Codex CLI Auto-Allow Permissions: Run Commands Without Approval Prompts

Codex CLI asks for approval before it writes files or runs commands. Automation tasks stall while you answer prompts. This guide shows the flags and settings that let Codex run without prompts. It also shows which settings are safe and which are not.

Two Layers of Permissions

Codex controls actions with two layers. The sandbox sets what commands can do. The approval policy sets when Codex must ask before it acts. You change each layer with a CLI flag or a config file setting.

Sandbox modes

read-only — Codex can read files and run safe commands. It cannot write.
workspace-write — Codex can edit files in the project folder. It cannot reach the network unless you enable network access.
danger-full-access — Codex can read and write anywhere on the machine.

Approval policy

on-request — The model decides when to ask for approval.
never — Codex never asks for approval.

The interactive command accepts the approval policy flag. The exec command does not. In exec mode, approval requests are denied by default. Use a sandbox flag or the bypass flag instead.

Auto-Allow Flags for codex exec

Use codex exec for scripted and CI runs. The run finishes without human input. These flags control what Codex can do without approval.

# Write inside the project folder. No approval prompt.
codex exec --sandbox workspace-write "Add a unit test for the parser"

# Route approval requests through automatic review.
codex exec --approve-for-me "Refactor the config loader"

# Run without any prompts or sandbox limits. Dangerous.
codex exec --dangerously-bypass-approvals-and-sandbox "Deploy the site"

The --approve-for-me flag sends approval requests to a reviewer agent. The reviewer approves or denies each action. It uses the workspace-write sandbox. The bypass flag removes all checks. Use the bypass flag only in a virtual machine or a container.

Interactive sessions have a shortcut. Type /permissions inside Codex to change the mode during a run. Type /status to view the active sandbox and approval policy.

Test Results

We tested each flag on Windows with Codex CLI version 0.153.4. These are the results.

Read-only sandbox — An echo command ran. No prompt.
Default exec mode — A file write was blocked. Codex reported: writing is blocked by read-only sandbox. No prompt.
Workspace-write sandbox — A file write succeeded. No prompt.
Approve-for-me — A file write succeeded after automatic review. No prompt.
Bypass flag — A file write succeeded. No prompt.

Persistent Settings in config.toml

Put the settings in ~/.codex/config.toml to apply them to every run.

# ~/.codex/config.toml
approval_policy = "never"
sandbox_mode = "workspace-write"
auto_review = "auto_review"

[sandbox_workspace_write]
network_access = true

The auto_review setting sends approval requests to the reviewer agent by default. Set network_access to true only when the task needs the internet.

Danger: The Bypass Flag

Warning: The --dangerously-bypass-approvals-and-sandbox flag removes every check. The model can delete files, install software, and send data over the network. It runs with no sandbox. Do not use this flag on your main computer. Use it only inside a disposable virtual machine or a CI container. OpenAI documents this flag for externally sandboxed environments only.

Old Flags That No Longer Work

Old guides show the --full-auto flag. Codex CLI 0.153.4 rejects it with the error unexpected argument '--full-auto' found. Use --dangerously-bypass-approvals-and-sandbox instead. Old guides also show the on-failure approval policy. That value is deprecated. Use on-request or never.

Summary

The sandbox sets what Codex can do. The approval policy sets when Codex must ask.
Use --sandbox workspace-write for unattended edits inside the project folder.
Use --approve-for-me to let a reviewer agent approve actions.
Use --dangerously-bypass-approvals-and-sandbox only in a disposable environment.
Persist settings in ~/.codex/config.toml.
The --full-auto flag no longer exists.