Codex replaces tool allowlists with a ToolPolicy captured once at startup

GitHub·medium signalXBlueskyLinkedInCopy link

PR #46999 (merged 2026-09-21, 13 files, +214/-106) replaces `AllowedTools` in openai/codex with `ToolPolicy`, combining an optional allowlist with managed-sandbox requirements, unified-exec requirements, and control over additional-permission arguments. The motivation is that allowlists alone could not express the reviewer's sandbox and shell restrictions, which previously hung off session identity. The security-relevant property is the timing: the policy is captured once at startup and applied during tool registration and construction, and later extension-state changes cannot relax it — explicit policies now take precedence over session identity, with the reviewer fallback kept for sessions that supply none.