The Codex error saying that permission profiles exist without default_permissions is not a request to disable safety. It means the effective configuration contains profile definitions but does not select a default profile.
The fastest fix is to decide which configuration model the run should use.
Path 1: keep the legacy sandbox model
Use this path when the run already relies on sandbox_mode, approval_policy, or [sandbox_workspace_write] settings.
Keep those settings together and remove unused [permissions.*] blocks. An explicit --sandbox flag also selects this model for the run.
Path 2: use permission profiles
Use this path when you want a built-in or named profile. Remove loaded legacy sandbox_mode settings, set default_permissions, and provide the matching profile block.
default_permissions = "project-edit"
[permissions.project-edit]
extends = ":workspace"
Enter fullscreen mode Exit fullscreen mode
Start from a bounded profile. Add filesystem or network exceptions only after the task proves it needs them.
No-prompt mode is not full access
approval_policy = "never" suppresses approval prompts. It does not widen the selected sandbox or permission profile. A workspace-bounded run remains workspace-bounded.
This distinction matters for unattended work. Removing prompts can make a bounded workflow repeatable, but it is not a substitute for defining the boundary.
Verify the effective run
Do not trust one TOML file in isolation. Record the Codex version, inspect every loaded config layer, resolve the named profile from the intended project root, and test write and network behavior with harmless operations.
A bounded profile-resolution probe on Windows is:
codex sandbox -P project-edit -C C:\absolute\project\path -- powershell -NoProfile -Command "Get-Location"
Enter fullscreen mode Exit fullscreen mode
This proves the profile name resolves. It does not prove write or network behavior, so test those separately.
The complete decision table, Windows sandbox guidance, failure signatures, and six-step boundary checklist are in the canonical TGWise guide:
https://tgwise.com/guides/codex-windows-permissions/
Disclosure: I maintain TGWise Agent Lab.
답글 남기기