13 | Codex Security and Team Governance: Approval, Sandboxing, and Least Privilege

Start with risk entry points, then efficiency

The upstream enterprise guide does not start by giving every person identical settings. It starts by identifying risk entry points: code and data sensitivity, whether tasks can write, MCP or connector access, plugins or automations, and whether environments or secrets reach a remote system. Repositories have different data classifications, so they should not all have identical permission policies.

Define what is allowed by default, what needs human approval, and what is prohibited.

Layers of the security architecture

• Approval and sandboxing constrain high-impact actions and their scope.
• AGENTS.md, Rules, and Hooks make project conventions and command boundaries testable.
• MCP and Connectors control external data, tools, secrets, and authorization scope.
• Plugins control source, version, capability, and retirement.
• Automations use still narrower permissions for unattended triggers.

These layers do not substitute for one another. Project rules cannot repair an overly broad external grant, and approval cannot replace explicit protection for sensitive files.

Write least privilege explicitly

A team baseline can use three sections:

Allowed by default: read-only analysis and low-risk checks in constrained directories.
Requires explicit human approval: writes, network access, external-system actions, and secret-related work.
Not allowed: unauthorized sensitive-data handling, approval bypasses, and protected-configuration changes.

List secrets, deployment configuration, production data, and customer data in project constraints. Windows teams should align PowerShell, path, and execution-policy requirements as well.

Governance after the initial setup

Security is not finished at installation. The course recommends MCP records, plugin governance, automation run logs, and team configuration review. On an incident, stop the relevant capability, preserve evidence, bound the impact, then recover or revoke through the established process.

A mature team does not ask for approval on every action. It reserves important actions for humans and keeps every automated or external operation traceable.