TL;DRThe right way to save approvals isn't flipping --yolo and walking away — it's railing in --full-auto first. The checklist comes from community security practice and verified behavior: pick the right tasks, leave escape routes, take prompts seriously, gate the output.
Sources SOURCES
Distilled from public community discussions. This page only breaks them down and verifies — it never reposts the original; opinions belong to their authors.
Facts FACTS
Check these claims against the listed sources. For allowance mechanics, first-party account displays outrank community summaries.
- In official terms,
--yolo/ --dangerously-bypass-approvals-and-sandbox disables the sandbox and approval layers at the same time — the highest-risk mode there is. - Verified behavior: under the on-failure policy, sandbox-failed commands still request approval — even in an automatic tier, prompts may not drop to zero. Recorded on GitHub.
- Community security write-ups cover using --full-auto safely specifically, treating guardrails as a precondition for auto mode rather than an optional extra — they're what makes auto mode a tier instead of a gamble.
- The workspace-write sandbox (Seatbelt on macOS) is the physical foundation of the guardrails — it draws the perimeter inside which auto-execution is allowed to roam.
Concepts CONCEPTS
Not everything said in a community thread is a fact — each concept carries its nature label. Read the label first.
The low-friction auto tier: work happens inside the sandbox, and it asks only on failure. The community runs it as the daily workhorse — provided the guardrails are in place.
The safety net you lay down before switching to auto: a clean git state, a dedicated branch, sensitive files out of the way, an explicit task boundary. Practitioner consensus, not an official requirement. None of it is clever — it's just making rollback boring.
An environment you can afford to lose: a separate clone, a one-off copy, a project holding no sensitive data. Community advice is to break in auto mode here first.
The tendency to rubber-stamp prompts when they fire constantly. The community discusses it as a real risk, but quantitative research is missing so far.
Step-by-step SOP STEP BY STEP
- 01Scope the eligible tasks
Enable
--full-autoonly for tasks that are bounded, reversible, and touch no sensitive data. Releases, deletions, and production config changes never qualify. When in doubt, the task doesn't qualify. - 02Leave an escape route
Run
git statusto confirm a clean tree, then cut a dedicated branch before starting. If it goes sideways, drop the whole branch. - 03Clear the room
Move keys, .env files, and production configs out of the workspace. Don't bet on the sandbox keeping your secrets — the safest layer is sensitive files not being there at all. Out of sight is out of blast radius.
- 04Start with boundaries
Launch
codex --full-autowith the task description stating "change only these directories, touch nothing else." The boundary belongs in the task, not in post-hoc corrections. - 05Take prompts seriously
Under on-failure, sandbox failures trigger approval requests (verified behavior). Read why it failed before allowing — a prompt you don't understand is information, not noise. Don't train yourself into instant approvals.
- 06Gate the output
Everything it produces must pass the repo's test and check commands, then a human diff review — tests catch what the agent broke, the review catches what it decided on its own. Confirm nothing smuggled in before you merge.
- 07Write the rules down
Record "when --full-auto is allowed, when manual is mandatory" in AGENTS.md or the team README, so the judgment call has a paper trail.
Keep reading NEXT
Want today's verdict? Back to the live radar.