A permission prompt is only as meaningful as the runtime that obeys it. In two merged changes on August 5, openai/codex began capturing a permission profile in each turn environment, then routed tool execution through that selected environment’s permissions. That sounds like plumbing. It is really a correction to where authority lives once a coding task has more than one workspace, process, or agent.
The newer change names the paths it touches: shell commands, unified execution, apply_patch, image viewing, network approval, Guardian review, and spawned or resumed agents. It also expands project-root rules across every workspace root in the selected environment. In plain terms, an approved edit in a second project root should use the same policy the turn was given, while protected paths stay protected.
Authority has to arrive at the tool call
Before this pair, a thread-level permission reading could drift from the environment that actually performed the work. The new turn-context code gives an environment its own permission profile and materializes project-root rules against its workspace roots. The Guardian path now reads that environment too when it explains denied paths. The test additions matter because they cover the awkward cases: a patch in a secondary root and permission context carried into multi-agent work.
The preceding change is the other half of the design. It refreshes retained environments after a settings change but preserves the configuration captured by an active turn. That is a deliberate choice against rewriting authority mid-flight. For a user, it means the question is no longer only “what are this thread’s settings?” but “which environment owns this work, and when did it capture them?”
Consistency is not a security certificate
The first angle was too generous: this is not evidence that Codex has solved tool safety. The public sources are implementation changes and tests on main; they do not prove a released client, a particular remote environment, or the safety of an action that policy already allows. They do show a mature boundary becoming less hand-wavy: the policy chosen for work must be available at the site of work.
If you supervise multi-root or delegated sessions, make the selected environment part of your review vocabulary. The next public signal worth watching is a regression test that changes roots or permissions while remote or child-agent work is already underway—where a clean model of “the environment owns the authority” is hardest to keep honest.