Codex sandboxing is the agent story I care about

Coding agents work against real state, so sandboxing matters more than personality.

A diff is only half the story. The other half is the filesystem boundary, command policy, network access, secret isolation, and recovery path around it. Those controls are what make an agent run reviewable.

Reading source, editing a post, changing a migration, and inspecting credentials are different permissions. A task may need broad read access and narrow write access. It may need tests but not network access. The runtime should make a boundary crossing visible.

{
  "paths": {
    "read": ["src", "scripts", "package.json"],
    "write": ["src/content/blog"]
  }
}

Shell commands need the same treatment. Running checks is not equivalent to installing dependencies, formatting a file, or deleting generated state.

{
  "commands": {
    "allow": ["pnpm markdown:check", "pnpm check", "pnpm astro check"],
    "ask": ["pnpm build", "pnpm install"],
    "deny": ["rm -rf", "git push"]
  }
}

Network and secrets are the sharp edges. Localhost is different from a package registry, which is different from an internal service. A workspace can contain environment files, shell history, credential helpers, and cloud auth state. The agent should not inherit all of that because the task is convenient.

network:
  localhost: allow
  package registry: ask
  arbitrary web: ask
  internal services: deny unless granted

secrets:
  environment: stripped
  dotfiles: blocked
  credential helpers: unavailable

Prevention is only half the value. Recovery makes the sandbox usable. A worktree makes the diff discardable. Command logs make failures replayable. Network records make unexpected dependencies explainable.

before:
  capture git status

during:
  log file writes and commands

after:
  show diff, checks, denied actions, and cleanup steps

Authority often drifts through reasonable-looking steps: a failing check points to a helper, the helper needs a fixture, the fixture exposes a dependency issue, and suddenly the run wants a broader write path and network access. Each escalation should become an explicit decision:

• new write path
• new command
• network access
• secret lookup
• external write

The useful metrics are plain: files touched, denied writes, permission escalations, commands run, network requests, discarded runs, accepted runs, and differences between the receipt and the final diff.

A sandbox is not a way to make an agent timid. It is a way to let a capable agent work without making the system impossible to understand.