Vibe Coding
Codex temporary structured threads now start read-only regardless of the managed permission profile
PR #46844 sets `default_permissions` to `:read-only` when a temporary structured thread starts without a custom permission profile, because managed permission profiles take precedence over the legacy sandbox override and a managed `:workspace` default was preventing those threads from starting at all. Custom profile handling is preserved, and the thread is rejected outright when read-only is disallowed by policy. For anyone running Codex under an enterprise-managed profile, this is the difference between recap-style threads silently failing to launch and launching with the narrowest permission set.
Source
↳ Follow the thread