01
Full access is one flag away
The sandbox mode that keeps Codex inside the workspace is set in config.toml and can be overridden on the command line. Nothing central sees which mode a developer is running in.
enforcement scopeone machine
Codexby OpenAIGovern · Codex
Codex, governed on the laptop and in the cloud.
Codex runs as a CLI on developer machines and as cloud tasks with access to your repositories. Its sandbox and approval modes are set per machine, in a config file. Agen judges every file, shell and repository action at runtime, against the developer behind it, and records the verdict.
Enforced on the endpointAgenShieldStopped on the device, before execution. The gateway's verdict, enforced where the gateway cannot see.
<30ms
per-action verdict at runtime
2
surfaces governed: endpoint and cloud
1:1
a named developer behind every run
1 day
from install to governing
How Agen governs Codex
- AgenShield governs the Codex CLI on the device: out-of-policy file edits, shell commands and MCP calls are stopped before they execute, whatever sandbox mode the developer chose.
- Cloud tasks that act on your repositories are decided at the gateway, where they touch your systems, tied to the developer who delegated the task.
- Each action resolves to the developer's identity from your IdP. Codex acts as a governed principal, not as a ChatGPT account.
- Policy returns a verdict in under 30ms: allow, mask, step up, hand to a human, or deny. Only the crossing action stops.
- Codex's config.toml, sandbox and approval policy stay as engineering set them. Agen adds the central verdict and the record.
What Codex reaches
A coding agent with two homes.
Codex is unusual in that it runs both on the developer's machine and as delegated tasks in OpenAI-hosted containers. Both reach your code.
- Files and shell, locally
- The CLI reads and edits files and runs commands with the developer's local privileges, inside whatever sandbox level is configured.
- Repositories, remotely
- Cloud tasks clone your repositories, make changes and open pull requests from an environment you do not run.
- Sandbox and approval modes
- Read-only, workspace-write or full access; approvals on request or never. Chosen per machine, per developer.
- MCP servers
- Connects to internal tools exposed as MCP servers, with tokens stored in the local config.
- IDE extension
- The same agent inside VS Code and its forks, acting on the open workspace.
- GitHub integration
- Reviews and acts on pull requests when tagged, using the installation's permissions.
Where the native controls stop
A sandbox level is a setting, not a policy.
Codex ships thoughtful defaults, and engineering should keep them. They are chosen per machine by the person the agent is acting for.
02
A ChatGPT account is not an enterprise identity
Codex signs in with the developer's ChatGPT account, then acts with the developer's local credentials. Neither maps to a governed principal your IdP knows about.
principala chat login
03
Cloud tasks act where no endpoint control runs
A delegated task runs in a container OpenAI operates, with repository access you granted. The device agent cannot see it and the settings file does not apply.
visible to endpoint toolsno
04
No shared record across the fleet
Session logs live on each machine and in each developer's account. There is nowhere to write one rule for every Codex run or to answer an auditor from one place.
central audit trailnone
How Agen governs it
One policy for the CLI and the cloud task.
The gateway decides. Shield enforces where the gateway cannot see. CLI actions are stopped on the device by AgenShield. Delegated tasks are decided at the gateway where they reach your repositories. Same rules, same identity, one record.
01 · Discover
Find every Codex install and task
Endpoint and repository telemetry surface every machine running the CLI, every cloud task touching your code, and every MCP server configured.
02 · Identify
Tie every run to a developer
CLI sessions and delegated tasks resolve to the developer's identity from your IdP. Codex becomes a governed principal with a named owner.
03 · Govern
Judge each action in-line
File writes, shell commands, MCP calls and repository changes are evaluated per action against policy and identity. Verdict in under 30ms.
04 · Evidence
Record the chain
Every action and verdict logged with developer, repo, command and decision, across both surfaces, exported to your SIEM.
Shield
The gateway decides. Shield enforces where the gateway cannot see.
The Codex CLI runs on the developer's machine, so AgenShield does the work: the gateway's verdict, enforced where the gateway cannot see. BrowserShield covers what the same developer pastes into AI tools in the browser. Cloud tasks are decided at the gateway where they reach your repositories.
ASPrimary for Codex
On the device
AgenShield
Out-of-policy actions like touching production secrets or mass-deleting files are stopped before they execute. Everything else flows. Ships through your MDM.
AgenShield · Codex CLI · dev-mbp-207blocked
Actionread · ~/.aws/credentials
Stoppedon device, before execution
Verdict27ms · logged
BS
In the browser
BrowserShield early access
Keys and sensitive data are recognised as they are pasted into AI tools, and the paste is blocked. Employees keep their tools. Only the leak stops.
BrowserShield · chatgpt.compaste blocked
Detectedrepository secret in paste
Everything elseflows normally
Verdictlogged · same audit chain
Governed actions
What Codex asks to do, and what policy says.
Illustrative verdicts for common Codex actions under a typical policy.
| Codex action | Verdict | Why |
|---|---|---|
| Edit files inside the workspace | allow | In scope for the developer and the task. Logged, not interrupted. |
| Run tests in workspace-write mode | allow | Normal engineering work inside the sandbox engineering configured. |
| Launch with the full-access sandbox flag | step-up | The developer confirms the elevated mode. The choice is recorded against their name. |
| Read a credentials file outside the workspace | deny | A production secret has no place in an agent's context. Blocked before the read completes. |
| Cloud task opens a pull request against a protected branch | human-in-the-loop | The delegating developer reviews before the change reaches the branch. |
| Query a customer database through an MCP server | mask | The query runs. Personal data is masked before it enters the model context. |
| Install a package from an unapproved registry | deny | Supply-chain scope. Stopped on the endpoint, logged centrally. |
| Push generated secrets to a remote | deny | Recognised at the point of exfiltration and blocked in-line. |
Verdicts are illustrative defaults. Every row is a policy you write once and Agen enforces per action, per identity.
Book a demo
See Codex governed, live.
Thirty minutes on the way your teams already use Codex. We show the verdict on each action, the named human behind the session, and the record it leaves. Bring your hardest question.
length30 minutes
formatlive, on your Codex setup
you seeevery action decided at runtime
Watch it happen
Codex reaches outside the workspace. On a laptop.
It never crosses your network controls, and no log outside that machine would record the attempt. AgenShield stops it on the device.
on-device block · live product scene
From install to governing
Rolled out like software. Nothing changes for the developer.
Codex stays exactly as your engineers use it today, on the laptop and in the cloud.
Day 1
Ship AgenShield through your MDM
The endpoint agent deploys to developer machines with the tooling you already use.
Day 1
Connect your IdP and repositories
Sessions resolve to developers through your IdP. Repository connections bring cloud tasks under the same policy.
Week 1
Run observe-only
See every Codex action across the fleet, including which sandbox modes are actually in use, before enforcing anything.
Week 2
Turn on the policies that matter
Start with secrets, protected branches and full-access mode. Developers only notice the crossing action.
The platform
Discover, Govern, Shield. One policy plane.
The same three capabilities govern Codex and every other agent you run, internal and external.
Continuous discovery across your IdP, gateway, devices, cloud, and registries. Nothing has to self-register: agents are found, risk-scored, and resolved to a named human before they act.
- Agentless and API-based across five surfaces
- First-party, custom, and third-party agents alike
- Every agent mapped to an owner, approver, and escalation
ClosesWhich agents are running that nobody registered?
no SDK required5 surfacesowner-mapped
Discover in depth →
FAQ
Questions, answered.
Does Agen replace Codex's sandbox and approval settings?
No. Engineering keeps config.toml, the sandbox level and the approval policy. Agen adds a central verdict on each action, anchored to the developer's identity, and a record that exists outside the machine.
How are cloud tasks governed if there is no device to install on?
Delegated tasks act on your repositories and systems, and that is where they are judged: at the repository, the gateway and the cloud connectors, tied to the developer who delegated the task.
Does it slow Codex down?
No. The verdict returns in under 30ms in-line with the action. Only an action that crosses policy pauses.
Can we see which developers run Codex with full access?
Yes. Discovery reports every install and the sandbox mode in use. You can require a step-up for full-access mode or deny it on specific machines.
Is this sold to individual developers?
No. Agen is deployed by the security or platform team across the fleet. Developers keep using Codex as they do today.
More platforms
Same policy plane. Different agent.
Govern Codex without taking it away.
One policy plane for the CLI and the cloud task, a named developer behind every run.