Definition
Sandbox
A sandbox is an isolated execution environment that constrains what AI-generated commands can affect. In Codex the sandbox policy is surface-specific and kept separate from approval, so what may run and what must be confirmed are two decisions. Claude Code and Cursor provide their own isolation controls.
Why it matters
Approval and isolation answer different questions. Approval asks whether you want this command run; the sandbox decides what a command can reach if it runs at all. Conflating them is how a confirmed command turns out to have reached further than anyone meant.
How each tool handles it
- Cursor
- Agent-level permissions with auto-review.
- Claude Code
- Manual, auto, plan and bypass where policy permits.
- Codex
- Auto, Read-only and Full Access; policy is surface-specific and separate from approval.
Frequently asked questions
Is a sandbox the same as an approval mode?
No. In Codex they are explicitly separate: the sandbox policy decides what a command can reach, the approval policy decides whether you are asked first. A permissive approval setting does not widen the sandbox.
Is `--full-auto` still the way to skip prompts?
No. The old --full-auto shortcut is deprecated. In Codex, on-request is the interactive policy and never suppresses prompts, with sandbox policy controlling execution separately.
Does the sandbox still apply in headless mode?
Yes, and it matters more there. Headless runs have nobody to answer an approval prompt, so the sandbox policy is what is left deciding how far a command can reach.