Codex Team Adoption in Practice: A One-Stop Decision Guide for Permissions, Conventions, and the Bedrock Path

When a team starts using Codex together, the first question from security and operations is usually not “Which plan should we buy?” It is “Who gets full access, what can .env read, and where do we look at usage and audit logs?” Those questions decide the first step in team adoption. The answer is not to pick an API key first. It is to define the permission boundary first. This article gives you a decision framework for enterprise adoption: configure requirements.toml and permission profiles to constrain member permissions, standardize shared AGENTS.md rules, choose a deployment route such as ChatGPT workspace, API Key, or Amazon Bedrock, and finally connect analytics and compliance. One fact also needs to be clear from the start: AWS announced GPT-5.4 availability in GovCloud on 2026-06-03, but the Codex Bedrock provider does not currently support GovCloud endpoints. Those are two different facts, not one.

1. Enterprise permission framework: do not let full access live on every local machine

When a company wants to standardize Codex, it can use cloud-managed requirements to constrain local behavior. requirements.toml is the policy configuration file for Codex. Administrators can assign different policies by user group instead of letting every member configure their own environment.

1.1 Key fields in requirements.toml

Here are the fields teams use most often when they land this rollout:

Field	Purpose	Recommended value
approval_policy	Controls whether human approval is required	"suggest" or "auto-edit"; do not use "never" as the team default
approvals_reviewer	Names the approver	The team owner or security owner
automatic_review_policy	Automatic review rules	Set per project risk level
permission profiles	Newer permission model (0.138.0+)	Recommended for new deployments
sandbox_mode	Older permission model	Use only for legacy migrations
web_search_mode	Whether web search is allowed	Optional, but should be restricted for sensitive projects
managed_hooks	Unified hook configuration	lint-check, test-runner, and similar hooks
MCP servers allowlist	Which MCP servers can be used	Only filesystem, github, and similar approved servers

Codex 0.138.0 and later recommends permission profiles with allowed_permission_profiles and default_permissions. Older deployments should still use allowed_sandbox_modes.

1.2 Forbidden combinations

The following combination must not be used as the team default:

danger-full-access + approval_policy = "never"

That is the highest-privilege, no-approval combination. It should be blocked in cloud-managed requirements so it does not appear in individual local configs.

1.3 Configuration example

# requirements.toml
[managed]
approval_policy = "suggest"
allowed_permission_profiles = ["suggest", "auto-edit"]
default_permissions = "suggest"

[mcp]
allowed_servers = ["filesystem", "github"]

[hooks]
managed_hooks = ["lint-check", "test-runner"]

This example limits members to "suggest" or "auto-edit", defaults to "suggest", allows only filesystem and github for MCP, and keeps the hook set consistent. If you want to give a core development group "auto-edit" while keeping interns on "suggest", cloud-managed requirements are the right place to do it.

2. Least privilege and sandbox design: concrete rules, deny glob, and sensitive-file protection

Security owners do not need a slogan about “least privilege.” They need concrete rules: which files can be read, which can be written, and which are completely forbidden.

2.1 Three filesystem values

Codex filesystem permissions support three values:

• read: read-only, no edits
• write: read/write, edits allowed
• deny: access is blocked entirely

The precedence rule is simple: more specific rules win, and deny has the highest priority. For example, if you configure both "**/*.env" = "deny" and ":workspace_roots" = "write", the .env files are still blocked even though the workspace root is writable.

2.2 Workspace scope limits

Use :workspace_roots to limit the working area. Example:

[permissions.filesystem]
":workspace_roots" = "write"

This lets Codex operate only inside the current workspace root and its children. It cannot reach files outside that scope.

2.3 Sensitive-file protection

You can use deny globs to keep sensitive environment files and secret directories out of reach:

[permissions.filesystem]
":workspace_roots" = "write"
"**/*.env" = "deny"
"**/secrets/**" = "deny"
"**/*.log" = "read"

This means:

• the workspace root and its children are writable
• all .env files are blocked, anywhere in the tree
• secrets/ directories and their children are blocked
• .log files are read-only

2.4 Network permission

Network permission can be enabled and controlled by domain allow/deny lists:

[permissions.network]
enabled = true
allow = ["github.com", "api.openai.com"]
deny = ["localhost", "127.0.0.1"]

That allows Codex to reach github.com and api.openai.com, while blocking localhost and loopback access. There is extra protection for local/private networks, so teams can also define domain lists for their own policies.

2.5 permission profiles vs sandbox mode

Comparison	Permission profiles	Sandbox mode
Release stage	Newer deployment model	Legacy deployment model
Granularity	Finer-grained	Coarser
Config fields	allowed_permission_profiles + default_permissions	allowed_sandbox_modes
Recommendation	Preferred for new deployments	Use mainly for legacy migration

New deployments should prefer permission profiles. Sandbox mode can be migrated away from gradually.

3. Shared team conventions: one AGENTS.md, not one custom file per person

Teams need a shared prompt, shared context rules, and shared review instructions. They do not need everyone maintaining their own separate version and splitting the maintenance burden into a dozen pieces. AGENTS.md is Codex’s instruction file. It supports layered rules and priority ordering.

3.1 Instruction chain order

When Codex starts, it builds an instruction chain in this order:

global rules (~/.config/codex/AGENTS.md)
  -> project rules (project AGENTS.md)
  -> nearest-to-current-directory rules

The closer file wins when there is overlap.

3.2 Layered architecture

Do not stuff every rule into one giant file. Split it into layers:

• ~/.config/codex/AGENTS.md: global rules, style, test expectations, general bans
• project AGENTS.md: architecture, dependencies, deployment style
• module AGENTS.md: module-specific needs

Each layer should stay around 10-15 KiB so maintenance stays manageable and truncation is avoided.

3.3 Handling the 32 KiB limit

Codex defaults project_doc_max_bytes to 32 KiB. If AGENTS.md grows too large, it can be truncated.

There are two ways to handle that:

1. raise project_doc_max_bytes
2. split the document into nested directories

Splitting is usually better because it keeps ownership and maintenance clearer.

3.4 What AGENTS.override.md is for

AGENTS.override.md is used to override upstream AGENTS.md and has the highest priority. Use it when:

• a specific subdirectory needs temporary rule overrides
• an experimental module needs looser limits
• a module differs from the project-wide policy

Record the reason for the override so team members do not get confused.

3.5 Team maintenance advice

When maintaining AGENTS.md, be explicit about:

• Ownership: who owns which layer
• Maintenance budget: how much review time each sprint gets
• Review cycle: whether to review global rules quarterly and project rules monthly

That turns AGENTS.md into a living shared reference instead of a private file each person rewrites.

4. Deployment choice: how to pick between ChatGPT workspace, API Key, and Bedrock

Organizations need to choose which account path they want to buy into. The three routes have different strengths, limits, and fit.

4.1 Comparison table

Dimension	ChatGPT Business/Enterprise	API Key	Amazon Bedrock
Authentication	ChatGPT sign-in	OPENAI_API_KEY	Bedrock API key or AWS IAM
Billing owner	OpenAI workspace	OpenAI API account	AWS account
Team governance	Analytics Dashboard, managed requirements	No native team governance	AWS IAM and CloudTrail
Feature completeness	Most complete	Most flexible	Partial feature set (see 4.2)
Compliance / region	OpenAI regions	OpenAI regions	AWS regions and data residency
GovCloud support	No	No	Model may be available, but Codex provider support is separate (see 4.3)
Best fit	Small/medium teams that need workspace management	Developers who want flexible integration	AWS-centric teams that need billing, IAM, and compliance controls

4.2 Missing Bedrock capabilities

As of 2026-06-08, the following capabilities are not available on this path:

• Fast Mode
• hosted web/file search
• computer use
• shell tool
• image generation tool
• remote MCP servers
• on-demand inference only is not supported; use Provisioned Throughput instead

These capabilities depend on OpenAI-hosted cloud services, hosted tools, or cloud-managed discovery, so they are outside this route. If your team depends on them, use ChatGPT workspace or API Key instead.

4.3 GovCloud clarification

There are two different facts here:

1. AWS GPT-5.4 in GovCloud (US-West) is available

   • the model itself is available in GovCloud
   • GPT-5.4 can be called through the Bedrock API

2. The Codex Bedrock provider does not support GovCloud endpoints

   • the amazon-bedrock provider for Codex does not currently support Bedrock Mantle endpoints in AWS GovCloud Regions
   • you cannot configure Codex against Bedrock in GovCloud today

Do not write “Codex on Bedrock supports GovCloud” as if those were the same fact.

4.4 Applicable scenarios

Choose the route based on the organization:

ChatGPT Business/Enterprise

• small and medium teams
• want workspace administration and management
• want the most complete feature set
• do not need AWS billing or IAM

API Key

• developers who want flexible integration
• no need for team governance
• pay directly on an OpenAI API account
• do not need compliance administration

Amazon Bedrock

• AWS-centric teams with existing AWS accounts, IAM, and billing
• want to aggregate charges under AWS commitments
• need data residency or specific AWS regions
• accept a partial feature set (see 4.2)

5. Bedrock configuration and limits: AWS-native auth, missing features, and GovCloud risk

Teams choosing Bedrock need to understand the exact setup, authentication method, missing capabilities, and the GovCloud boundary.

5.1 Configuring the amazon-bedrock provider

Set the provider in the Codex config file:

{
  "provider": "amazon-bedrock",
  "aws_region": "us-east-1",
  "model_id": "openai.gpt-5.5"
}

The model ID and region should follow the official docs.

5.2 AWS-native auth

The Bedrock path uses AWS-native authentication, not OPENAI_API_KEY:

• Bedrock API key: short-lived key, max 12 hours or session duration, inherits IAM principal permissions
• AWS IAM credentials: configured through IAM role or IAM user

For production, short-lived keys or IAM roles are recommended. Long-lived keys are only for exploration.

5.3 Supported commercial AWS regions

The official docs currently support these commercial AWS regions:

• us-east-1
• us-west-2
• eu-west-1
• ap-northeast-1

Use the AWS Bedrock OpenAI models docs for the current list.

5.4 Bedrock API key governance

Key governance rules for Bedrock:

• Short-term key: up to 12 hours or the session duration, inherits IAM principal permissions, recommended for production
• Long-term key: for exploration only, not recommended for production
• CloudTrail logging: API calls are recorded in AWS CloudTrail; the key itself is not logged in plaintext
• IAM actions control: IAM actions can control who can create and use API keys

5.5 Missing capabilities list (repeated)

As of 2026-06-08, the following are not available on Bedrock:

• Fast Mode
• hosted web/file search
• computer use
• shell tool
• image generation tool
• remote MCP servers
• on-demand inference only is not supported; use Provisioned Throughput

If the team depends on these features, switch to ChatGPT workspace or API Key.

5.6 GovCloud risk (repeated)

Again, separate these two facts:

• AWS GPT-5.4 is available in GovCloud (US-West): the model itself is available in GovCloud
• The Codex Bedrock provider does not support GovCloud endpoints: you cannot configure Codex against Bedrock in AWS GovCloud Regions today

If your team needs GovCloud, do not assume Codex can already be pointed there.

6. Governance and audit: where to see usage and compliance logs

Managers need to track adoption, usage, and code review impact, and they need analytics and audit output for that.

6.1 Comparison of the three governance paths

Path	Capability	Delay	Best for
Analytics Dashboard	adoption, usage, code review feedback	Usage data may lag up to 12 hours	Tracking rollout performance
Analytics API	daily/weekly buckets, workspace/per-user usage, per-client breakdown, Code Review metrics	Near real time to a few hours	Cost governance and deeper analysis
Compliance API	exports Codex activity and audit metadata	Depends on SIEM/eDiscovery integration	Compliance auditing

6.2 Usage scenarios

6.2.1 Rollout tracking

Use the Analytics Dashboard to look at team adoption and usage:

• member activation rate
• code review feedback quality
• usage distribution by client

Dashboard data can lag by up to 12 hours, so it is better for weekly or monthly reporting than for real-time monitoring.

6.2.2 Cost governance

Use the Analytics API for deeper analysis:

• split usage by workspace/user/model
• compare daily and weekly buckets
• break down usage by client (Codex App/CLI/IDE/Cloud)
• summarize Code Review metrics

This is the right route for internal cost governance and optimization work.

6.2.3 Compliance auditing

Use the Compliance API to export audit logs:

• Codex activity records
• audit metadata
• SIEM/eDiscovery integration
• compliance review support

This is the path for regulated organizations such as finance, government, and healthcare.

6.3 Governance path recommendation

• Analytics Dashboard: best for technical owners and project managers tracking team rollout
• Analytics API: best for platform engineers doing cost governance and deep analysis
• Compliance API: best for security and compliance teams integrating with SIEM and eDiscovery

The three paths can be combined based on organizational needs.

7. Team rollout path: from individual trial to organizational governance

Teams often do not know where to start, how to stage adoption, or how to choose the first batch of pilot tasks.

7.1 Three-stage rollout framework

Stage 1: individual control (define the permission boundary)

Goal: make sure each member’s permission boundary is controllable so sensitive files do not spread across local machines.

Core actions:

• forbid danger-full-access + approval_policy = "never" as the team default
• protect .env and secrets/ with deny globs
• set :workspace_roots to limit the working area

Success criterion: no member can access sensitive files without approval.

Stage 2: small-team pilot (shared conventions + low-risk tasks)

Goal: unify AGENTS.md and skills within the small team, then start with low-risk tasks to verify that the workflow works.

Core actions:

• write a global AGENTS.md (style and test expectations)
• write a project AGENTS.md (architecture, dependencies, deployment)
• choose low-risk tasks such as docs generation, lint fixes, and test additions
• avoid direct production deployment or payment logic automation

Success criterion: most members use the shared AGENTS.md and there are no major safety incidents.

Stage 3: organizational governance (managed requirements + Analytics/Compliance API)

Goal: elevate permissions and conventions to organization-level governance and connect observability and audit.

Core actions:

• configure cloud-managed requirements by user group
• connect Analytics Dashboard/API for adoption and usage tracking
• connect Compliance API to SIEM
• review permission profiles and MCP allowlists regularly

Success criterion: the governance dashboard is online and audit logs are traceable.

7.2 Suggested pilot tasks

Prefer low-risk tasks first

Good tasks for the first pilot batch:

• document generation: README, API docs, note cleanup
• lint fixes: eslint, prettier, formatting automation
• test additions: unit tests and integration test skeletons
• refactoring suggestions: code structure improvement ideas (with human review)

Avoid direct automation

Bad tasks for the first pilot batch:

• production deployment
• payment logic
• permission changes
• data deletion

These tasks are high risk and should wait until governance and auditing are mature.

7.3 Relationship to the rest of the series

This article is the team adoption decision page, and later articles can go deeper:

• AGENTS.md writing style: how to write layered rules, avoid truncation, and maintain them
• personal blockers and sandboxes: permission issues, sandbox setup, and common mistakes
• Cloud/GitHub integration: remote development, GitHub review, cloud tasks
• cost and quota optimization: token reduction skills and budget control
• automation and long-running tasks: scheduled triggers, heartbeats, and cross-day jobs

Summary and Next Steps

If you are a technical owner rolling out Codex to a team, the order should be:

1. Read the permission configuration first (Sections 1 and 2) to block the dangerous combinations
2. Standardize conventions next (Section 3) so AGENTS.md has a shared shape
3. Choose the deployment path after that (Sections 4 and 5) to decide among workspace, API Key, and Bedrock
4. Connect governance last (Section 6) through Analytics and Compliance APIs

Then you can move into more specific modules:

• AGENTS.md writing style: how to write layered rules, avoid truncation, and maintain them
• personal blockers and sandboxes: permission issues, sandbox setup, and common mistakes
• Cloud/GitHub integration: remote development, GitHub review, cloud tasks
• cost and quota optimization: token reduction skills and budget control
• automation and long-running tasks: scheduled triggers, heartbeats, and cross-day jobs

Related basics:

• Team Git collaboration basics: Git flow, branch strategy, and code review workflow
• CI secrets and permission safety: GitHub Actions secrets, permission boundaries, and security practices