Permissions
Choose how much an agent may do on its own, from asking before every protected action to full access, and answer its approvals and questions.
The permission control sits in the composer, next to the send button. It decides how much the agent may do without asking you.
| Mode | What it means |
|---|---|
| Ask for approval | Always asks before editing files outside the project or using the internet. |
| Approve for me | An AI reviewer approves routine actions and only asks you about risky ones. |
| Full access | No prompts: the agent can use the internet and any file on your computer. |
Full access is the default. Pick a stricter mode for unfamiliar repositories or tasks you don’t want to supervise closely.
Approvals and questions
When an agent needs permission or an answer, the request appears in the chat and the chat shows an amber dot in the sidebar. Approve or deny it there, or answer the question. Questions with choices can be answered with the number keys; Cancel dismisses the whole request.
Codex can also ask questions while it keeps working. Those appear above the composer and wait for you without blocking the turn.
Computer Use is separate
Permission modes cover files, commands and the network. Using apps on your desktop is controlled separately, per app, the first time an agent asks. See Computer Use.