Giving an agent permissions is the same class of problem as giving an employee permissions: not 'whether', but 'at what granularity, and can it be revoked at any time'. Codex's Permissions section answers with five layers. Profiles are preset permission combinations, letting teams switch between tiers like 'read-only / write-workspace / needs-network' per scenario; Sandboxing puts the agent's execution into an isolated environment so high-risk actions like running tests or installing dependencies stay separated from the host filesystem; Auto-review gates every code change before it lands, acting as a first quality-and-safety checkpoint; Agent approvals & security turns 'which actions require a human sign-off' into configurable policy; Internet access is controlled separately, keeping the agent from quietly reaching the network. Stacked together, these five layers turn 'least privilege' from a principle into a configurable, auditable engineering mechanism.
For Zero to Pro Agent Harness learners, these five layers are a permission-design checklist to copy directly: whether you're building a Codex integration or your own harness, ask yourself — do I have profiles? a sandbox? pre-landing auto-review? an approval gate? is network a separate switch? Answer those five and an agent's permission boundary is basically drawn. For Zero to Codex learners, the most practical are Sandboxing and Auto-review: put 'run tests' and 'install dependencies' in a sandbox and turn on 'review every change before it lands' to sharply reduce the risk the first time you let an agent touch real code.