How to Lock Down Codex Browser and Computer Use with Managed requirements.toml Policies

Why September 3 Changes the Codex Lockdown Conversation

OpenAI’s September 3, 2026 release notes add a materially more granular policy surface for Codex enterprise browser and native-app computer use. The practical change is not that administrators can suddenly “trust” browser automation or desktop control; it is that they can now express narrower defaults and exceptions for supported browser origins and supported macOS or Windows applications. OpenAI says administrators can set website defaults and exceptions, restrict uploads and downloads, control browser history and developer access, configure automatic review and saved approvals, set approval duration, restrict browser-data imports, and allow or block specific native applications. For enterprise administrators, this turns Codex computer use from a broad enable-or-disable decision into a layered runtime policy problem.

This playbook treats those controls as preventive guardrails, not as a replacement for identity governance, endpoint management, network filtering, or human review. OpenAI’s managed-configuration documentation distinguishes administrator-enforced requirements from user-adjustable managed defaults. That distinction is the first implementation decision: use requirements when a setting is security-sensitive and must not be weakened by an individual user during a run; use managed defaults when the organization wants a standard starting posture but can tolerate user changes for a specific task. The wrong choice creates avoidable risk: a “default” that users can change is not a control you can rely on in an audit or incident review.

The September 3 release is especially important for teams that previously handled Codex browser access with coarse operational rules such as “only use staging systems” or “do not open production admin consoles.” Human instructions are useful, but they are not the same as enforceable runtime configuration. OpenAI’s Codex safety guidance describes the broader objective as allowing low-risk actions inside bounded environments while stopping higher-risk actions for review. Managed requirements.toml policy is one of the places where those boundaries become explicit: what origins are allowed, whether uploads are blocked, whether browser history can be accessed, whether full Chrome DevTools Protocol access is permitted, whether saved approvals can persist, and whether native applications are denied by default.

Administrators should also read the release narrowly. OpenAI’s release notes state that allowing a website or application does not override other policies or approval prompts. That means an allow rule is not a universal pass. If the network layer blocks an origin, the local browser allow rule does not create connectivity. If an action still requires approval, a browser allow rule does not silently approve it. If an operating system denies an app permission, a Codex managed policy does not grant that OS permission. Treat allow rules as one necessary condition in a multi-layer decision, not as the final authorization outcome.

For Codex Computer Use Guide, How to Use OpenAI Codex Computer Use: Step-by-Step Tutorial for 2026 is the most relevant adjacent resource. The step-by-step Codex computer-use tutorial explains browser and desktop task execution, giving administrators a practical baseline before they restrict those capabilities.

The Control Model: Workspace RBAC Is Not Local Runtime Policy

The most common deployment mistake is mixing up workspace role-based access control with local runtime enforcement. Workspace RBAC answers questions such as who can access the workspace, which roles can use a feature, and which administrative settings apply to a class of users. Local runtime policy answers a different question: once a supported Codex client is running on an endpoint, what browser and native-app actions are constrained by administrator-managed configuration? Both are required in a serious enterprise rollout, but neither one replaces the other.

For example, restricting a workspace role may prevent a user from accessing a Codex feature in the first place, but it does not document the exact browser-origin policy for an approved Codex user’s workstation. Conversely, a strict local requirements.toml policy can deny native applications by default and allow only approved identities, but it does not add the user to the correct workspace, grant repository access, or assign an enterprise role. If a user lacks workspace authorization, local policy should not be interpreted as a way to “enable” the feature for them.

OpenAI’s managed-configuration documentation also makes clear that managed requirements and allow rules do not install plugins or software, and they do not grant operating-system permissions. This matters when security teams review native-app computer use. A macOS bundle identifier or a verified Windows application identity in policy is not an installation mechanism, a software distribution channel, or a privilege elevation path. The endpoint still needs approved software deployment, code-signing validation where applicable, operating-system permissions, endpoint detection coverage, and change management. The Codex policy defines what supported Codex computer use may interact with; it does not make the endpoint trustworthy by itself.

Requirements Versus Managed Defaults: The Decision Rule

OpenAI’s documentation draws the operational line between requirements and managed defaults. Requirements constrain security-sensitive runtime settings and cannot be weakened by users. Managed defaults provide initial values that users may change during a run, and the client reapplies them at restart. The decision rule is straightforward: if the setting protects data, credentials, production systems, audit integrity, or user consent boundaries, put it in requirements; if it improves consistency but does not define the risk boundary, consider a managed default.

Browser uploads are a good example. If your organization cannot permit Codex-controlled browser sessions to upload local files into arbitrary web applications, that belongs in administrator-enforced requirements. A user preference is insufficient because a single run could expose source code, credentials, exported customer records, or unreleased product documents. Browser downloads may be more contextual: a team might deny downloads for production support roles but allow downloads from specific internal build or artifact origins for engineering roles. The policy design should reflect the data-flow risk, not the convenience of the task.

Persistent approvals and approval duration deserve similar treatment. Saved approvals can reduce friction, but they also change the review cadence for repeated actions. If your risk model assumes that higher-risk actions are reviewed at the moment they occur, persistent approval should be disabled or tightly bounded through enforced requirements. If your organization permits short-lived approval reuse for a controlled internal origin, document the maximum lifetime and test the effective policy on the supported client version before expanding it.

Operational warning: Do not classify a setting as a managed default merely because it is easier to roll out. If an auditor, incident responder, or security owner would expect the control to be non-bypassable, it belongs in requirements or in another enforceable control layer outside Codex.

For Enterprise Managed Configuration, The Codex Enterprise Deployment Playbook: 12 Prompts for Team Onboarding, Access Control, and Usage Governance is the most relevant adjacent resource. The Codex enterprise deployment playbook covers centrally governed access and usage policies, complementing this article’s requirements.toml enforcement details.

Precedence Layers: Where Effective Policy Comes From

Enterprise deployments rarely have a single source of truth on day one. OpenAI’s managed-configuration documentation describes a policy stack that can include system requirements, cloud-managed requirements, legacy managed configuration, and macOS managed preferences, with higher-precedence sources taking priority according to the documented merge behavior. The operational implication is that administrators should reason about the effective policy, not just the file they most recently edited.

A safe rollout starts by inventorying every configuration source that could affect Codex. Cloud-managed requirements may represent the intended enterprise baseline, while an older legacy managed configuration might still exist on endpoints. macOS managed preferences may be distributed through device-management tooling. System requirements may set non-negotiable boundaries. If these sources disagree, the highest-precedence source wins according to OpenAI’s documented merge rules. Your deployment checklist should include a conflict review before you interpret a test result as a product bug or user misconfiguration.

Policy precedence also affects emergency changes. Suppose security discovers that a specific origin should no longer be available to Codex browser use. If a lower-precedence file denies the origin but a higher-precedence cloud requirement allows it, the emergency deny may not have the intended effect. Conversely, a high-precedence default-deny requirement may make a lower-precedence allowlist ineffective. Security teams should predefine which configuration channel is authoritative for emergency revocation and confirm that device-management propagation, client restart behavior, and effective-policy inspection are part of the incident procedure.

Recommended opening inventory for policy owners:
1. Identify every Codex managed-configuration source in use.
2. Record which source has precedence for requirements.
3. Separate administrator-enforced requirements from user-adjustable defaults.
4. Confirm which client versions support the browser and native-app keys you plan to use.
5. Test the effective policy on representative macOS and Windows endpoints.
6. Preserve evidence: policy source, client version, test user, test origin, test application, observed result.

Client-Version Dependencies Are a Security Requirement, Not a Release Detail

New policy keys are only useful when the deployed client understands and enforces them. The September 3 release notes describe new granular controls, but administrators should not assume that every endpoint in the fleet can enforce every new setting immediately. OpenAI’s broader documentation already shows that client versions matter in Codex; for example, GPT-6 Astra access in Codex has documented client-version requirements. The same operational principle applies to managed configuration: validate support for newer policy fields before you rely on them for enforcement.

The minimum practical standard is a compatibility matrix. List each planned control category—browser origin default, per-origin exception, upload restriction, download policy, history access, persistent approval, approval duration, full CDP access, automatic review, browser-data import, native macOS application allow rules, and Windows verified application identities. For each category, record the supported client version or deployment requirement from OpenAI’s documentation, the endpoint population that meets it, and the test result. If a control cannot be confirmed on a client build, do not count that endpoint as protected by the new policy.

This is especially important in mixed desktop estates. macOS application policy depends on approved bundle identifiers, while Windows application policy depends on verified identity fields rather than display names alone. A Windows display name such as “Contoso Editor” is not an adequate security identifier because display names can be ambiguous, localized, or changed. Your allowlist process should require the verified Windows application identity fields documented by OpenAI and should reject tickets that provide only a friendly name, icon, installer filename, or user screenshot.

Default-Deny Is the Baseline; Exceptions Are the Product

The recommended enterprise starting point is default-deny for browser origins and native applications, followed by narrow, documented exceptions. Default-deny does not mean Codex becomes unusable; it means each allowed destination or application must have an owner, a purpose, and evidence that the exception does not bypass other review layers. The most mature organizations will treat exceptions as small products with lifecycle management: request, review, approval, deployment, validation, expiration, and removal.

For browser use, default-deny starts with blocking access by default and adding per-origin exceptions only where the task requires them. An origin exception should be as specific as the policy model supports and should be tied to a business workflow. An internal documentation site used for codebase onboarding has a different risk profile from a production admin console, a customer-support tool, or an external file-sharing service. Upload and download rules should be evaluated separately because read access to a page is not the same risk as exfiltrating a file into that page or saving content back to the workstation.

For native computer use, default-deny means unsupported or unapproved applications are not available simply because they exist on the endpoint. On macOS, build the allowlist around approved bundle identifiers. On Windows, build it around verified executable identities or application user model identifiers where OpenAI’s documentation requires those fields. Do not approve by broad categories such as “all browsers,” “all terminals,” or “all office apps” unless the organization has formally accepted the resulting blast radius and tested the interaction with approvals, endpoint controls, and data-loss-prevention policy.

The Safe Baseline for This Playbook

The baseline used throughout the rest of this playbook is intentionally conservative: deny browser access by default; add per-origin exceptions only after review; deny or tightly restrict uploads; allow downloads only where the workflow requires them; disable browser-history access unless there is a documented need; disable persistent approvals unless approval reuse is explicitly risk-accepted; avoid full Chrome DevTools Protocol access by default; keep automatic review constrained according to your security model; deny native applications by default; and allow only approved macOS bundle identifiers or verified Windows application identities. This baseline is a recommendation, not an OpenAI-mandated default.

The baseline also assumes that managed requirements are part of a larger control set. Workspace RBAC determines who should have access. Endpoint management determines which devices and applications are trusted. Network policy determines which destinations are reachable. Codex managed configuration constrains supported browser and computer-use behavior inside that environment. OpenAI’s safety materials describe additional controls such as sandbox boundaries, approval policies, managed network access, protected identity and credentials, command rules, telemetry export, and compliance logs for Enterprise and Edu contexts. A production rollout should map each of those layers to an owner before broad deployment.

The next sections turn this model into implementation work: how to structure administrator-enforced requirements, how to design browser origin exceptions, how to handle upload and download decisions, how to define macOS and Windows application allowlists, how to use feature pins without overexposing high-risk capabilities, and how to test effective policy before declaring the rollout complete.

Browser Policy Baseline: Deny Origins First, Then Allow Only the Work Surface

The browser-use portion of a managed requirements.toml policy should start from the same premise as a production firewall rule set: the default is deny, and every exception must describe a legitimate work surface. OpenAI’s managed-configuration documentation states that administrators can set browser website defaults and exceptions, control uploads and downloads, restrict browser history, disable persistent approval, deny full Chrome DevTools Protocol access, disable automatic review, and set approval lifetimes. The release notes add an important operating rule: allowing a site does not override other policies or approval prompts, so an origin allowlist is only one layer of the final decision.

Use this section as the browser baseline for the playbook, then adapt the origin list to your repositories, documentation systems, issue trackers, package registries, and internal developer portals. The examples below are syntactically valid TOML and are intentionally conservative. Before enforcing them broadly, compare the key names and supported values with the OpenAI managed-configuration reference for the Codex client version you deploy, because newer browser and computer-use controls require client support to have the intended effect.

Operational warning: a browser allow rule is not a data-loss-prevention exception, an identity grant, an operating-system permission, or a bypass for approvals. If the user lacks access to a site, the managed browser policy does not create access. If the network layer denies the destination, the browser policy does not reopen it. If a risky action still requires approval, the origin exception does not remove that approval requirement.

Decision rule for browser origins

The baseline should allow only HTTPS origins that are necessary for the agent’s development task. Prefer exact origins such as https://github.com, https://docs.github.com, or an internal documentation hostname over broad domain patterns. Do not allow plain HTTP origins in the baseline, because a browser agent that can navigate to an unencrypted origin may expose prompts, code context, repository names, query parameters, or downloaded artifacts to interception or modification outside the Codex policy stack.

Separate read-only research surfaces from surfaces where an agent can change state. For example, product documentation, API references, and internal runbooks may be reasonable browser destinations with downloads enabled for static artifacts, while issue trackers, source-code hosts, SaaS admin panels, and cloud consoles require narrower review because clicks, forms, file uploads, and authenticated sessions can create durable changes. The baseline below therefore denies uploads globally, denies downloads by default, disables history access, denies full CDP access, denies saved approvals, and makes any approval expire at the end of the current turn.

For Codex Browser Security, How to Set Up and Use the OpenAI Codex Chrome Extension for Browser-Based AI Development is the most relevant adjacent resource. The Codex Chrome extension tutorial documents browser-based development workflows and permissions, helping readers identify which origins and actions need explicit policy.

Baseline requirements.toml for browser use

Recommendation: start with this default-deny browser profile for workstations or managed environments where Codex may need limited browser access to public documentation and approved engineering systems, but should not freely browse the internet, import browser data, persist approvals, or use unrestricted developer instrumentation.

# requirements.toml
# Conservative browser-use baseline for managed Codex environments.
# Validate field support against the deployed Codex client and OpenAI's
# managed-configuration documentation before broad enforcement.

version = 1

[features]
browser_use = "enabled"
in_app_browser = "enabled"
external_browser_use = "disabled"
full_cdp_access = "disabled"

[browser]
default_origin_policy = "deny"
allow_uploads = false
allow_downloads = false
allow_browser_history_access = false
allow_persistent_approvals = false
approval_lifetime = "turn"
automatic_review = "disabled"
allow_browser_data_imports = false

[[browser.origins]]
origin = "https://github.com"
policy = "allow"
allow_uploads = false
allow_downloads = false
automatic_review = "disabled"

[[browser.origins]]
origin = "https://docs.github.com"
policy = "allow"
allow_uploads = false
allow_downloads = true
automatic_review = "disabled"

[[browser.origins]]
origin = "https://developer.mozilla.org"
policy = "allow"
allow_uploads = false
allow_downloads = true
automatic_review = "disabled"

[[browser.origins]]
origin = "https://www.npmjs.com"
policy = "allow"
allow_uploads = false
allow_downloads = false
automatic_review = "disabled"

[[browser.origins]]
origin = "https://pypi.org"
policy = "allow"
allow_uploads = false
allow_downloads = false
automatic_review = "disabled"

This baseline deliberately treats source-code hosting as an allowed navigation surface but not as an unrestricted file-transfer surface. A Codex task may need to read repository pages, pull-request discussions, issue text, or project documentation in a browser, but uploading files through the browser should remain denied unless a specific workflow has been reviewed. Downloads are allowed only for documentation-oriented origins in the example, where the likely artifact is a static reference page or file; if your environment has stricter controls, keep downloads denied everywhere and require source-controlled retrieval through approved command, package, or artifact systems.

The external_browser_use pin is disabled in this profile to keep browser activity inside the managed Codex surface instead of handing off to a user’s everyday browser profile. That reduces accidental exposure to personal sessions, extensions, cookies, and history, and it makes testing easier because the browser path is controlled. The allow_browser_data_imports setting is also denied, because importing existing browser data can blend unmanaged user context with the agent’s work environment.

Field table for the browser baseline

Adding a controlled upload exception

Uploads should be rare because a browser upload can move source code, logs, screenshots, build artifacts, customer data, or credentials into a third-party system. If a team has a reviewed use case, scope the exception to the narrowest HTTPS origin and keep persistent approvals disabled. For example, a company may allow uploads only to an internal ticketing attachment endpoint or an approved private documentation system, not to every site that happens to be useful for engineering research.

# requirements.toml excerpt
# Narrow upload exception for an internal engineering system.

[[browser.origins]]
origin = "https://eng-support.sample.test"
policy = "allow"
allow_uploads = true
allow_downloads = false
automatic_review = "disabled"

[browser]
allow_persistent_approvals = false
approval_lifetime = "turn"

Review rule: do not approve an upload exception merely because the site is trusted. Approve it only when the uploaded file classes are known, the destination is governed, the business purpose is documented, and the user still receives an approval prompt for higher-risk actions when required by the rest of the Codex safety stack. OpenAI’s safety framing for Codex emphasizes low-risk actions inside bounded environments and higher-risk actions being stopped for review; browser upload exceptions should preserve that separation.

Adding a controlled download exception

Downloads are lower risk than uploads for confidentiality but still matter for supply-chain safety, malware exposure, license exposure, and workspace contamination. A browser policy that permits downloads from package registries or documentation sites should not be treated as permission to execute downloaded content. Keep execution governed by sandboxing, command rules, operating-system controls, and repository workflow review.

# requirements.toml excerpt
# Download exception for a documentation host that publishes static reference files.

[[browser.origins]]
origin = "https://docs.internal.sample.test"
policy = "allow"
allow_uploads = false
allow_downloads = true
automatic_review = "disabled"

Decision rule: permit downloads from documentation systems when the expected content is reference material, exported specifications, or approved project assets. Do not permit downloads from arbitrary file-sharing domains, personal cloud drives, paste sites, or public forums in the baseline. If a workflow needs those destinations for incident response or support analysis, place it in a separate high-friction profile with shorter approval lifetime, human review, and audit evidence.

Network policy interaction: origin allow is necessary, not sufficient

OpenAI’s release notes state that allowing a site or application does not override other policies or approval prompts. In practice, that means the browser origin allowlist and the managed network policy must be aligned. If the browser policy allows https://github.com but the network policy denies outbound access to that host, the browser should still fail to reach it. Conversely, if the network policy allows a broad egress range but the browser origin default is deny, the managed browser should still block unlisted origins.

# requirements.toml excerpt
# Companion network posture shown to illustrate policy interaction.
# Use the network keys supported by your managed-configuration version.

[network]
default_policy = "deny"

[[network.destinations]]
host = "github.com"
ports = [443]
policy = "allow"

[[network.destinations]]
host = "docs.github.com"
ports = [443]
policy = "allow"

[[network.destinations]]
host = "developer.mozilla.org"
ports = [443]
policy = "allow"

[[network.destinations]]
host = "www.npmjs.com"
ports = [443]
policy = "allow"

[[network.destinations]]
host = "pypi.org"
ports = [443]
policy = "allow"

Test browser and network controls as a pair. A practical validation script is to attempt one allowed origin, one denied origin on an otherwise reachable network, one allowed browser origin that is intentionally omitted from the network allowlist, and one denied browser origin that the network would otherwise permit. This four-case test proves whether the effective policy is the intersection of browser and network controls rather than the union of whichever layer is most permissive.

Production exception workflow for browser origins

1. Record the task: document the repository, team, business workflow, and why browser access is required instead of command-line, API, or existing repository context.
2. Classify the origin: mark the destination as documentation, source-code host, issue tracker, package registry, internal tool, SaaS admin panel, or file-transfer service.
3. Choose data movement: keep uploads denied unless the workflow explicitly requires file submission; keep downloads denied unless the site is an approved source of artifacts or documentation.
4. Check identity scope: verify that the user’s workspace and site permissions are appropriate, because managed browser policy does not grant application access.
5. Check network scope: confirm the destination is also allowed by managed network access where required; do not widen network egress just to make a browser exception convenient.
6. Set approval lifetime: use turn-scoped approval for the baseline so the user must re-evaluate materially similar actions in later turns.
7. Retest effective policy: verify allowed navigation, denied navigation, denied upload, denied history access, denied full CDP access, and non-persistence of approvals before rollout.

The most common policy mistake is treating the first successful page load as proof that the control is correct. A browser baseline is correct only when the negative tests succeed: unlisted origins fail, HTTP variants fail, uploads fail where denied, downloads fail where denied, history access fails, full CDP access fails, and approvals do not persist beyond their intended lifetime. Capture those negative test results as rollout evidence so later exceptions can be reviewed against the same standard.

Native-App Lockdown: Allow Identified Applications, Not App Categories

OpenAI’s September 3 release notes state that Codex enterprise policy settings now include more granular controls for supported browser and native-app computer use, including the ability to allow or block specific macOS and Windows applications. The important operational detail is that an application allow rule is not a grant of trust to everything that application can reach. OpenAI’s managed-configuration documentation treats managed requirements as administrator-enforced constraints, and it separately warns that allow rules do not install software, grant operating-system permissions, or bypass other review requirements.

The native-app policy objective is therefore narrower than “let Codex use the developer workstation.” A production policy should answer four questions for every host class: whether computer use is pinned on or off, which application identities are allowed when computer use is available, which permission profile applies to the task, and which local resources remain unreadable even when an allowed app is open. If any one of those controls is missing, a benign-looking exception can become a broad pathway into terminals, password managers, browser profiles, cloud-sync folders, or release-signing material.

Operational rule: deny native applications by default, then allow only durable application identities that are tied to a documented job function. A display name, user-installed shortcut, or “anything under this folder” is not a sufficient production identity for Windows, and a marketing product name is not a sufficient identity for macOS.

Feature pins decide whether users can weaken computer-use controls

OpenAI’s managed-configuration model distinguishes requirements from managed defaults. For native computer use, the practical distinction is simple: a managed default may start the client in a safe state, but a requirement prevents the user from weakening that state during a run where the key is supported. Feature pins are the right control for security-sensitive toggles such as computer use, in-app browser use, external browser use, browser use, and full browser developer access when your policy set includes those features.

A locked computer-use policy should be explicit about whether the organization is enabling the capability at all. For high-risk endpoint groups, pin computer use off rather than relying on an empty allow list; this produces a clearer support signal and avoids ambiguous troubleshooting when a user believes the feature should work. For approved engineering endpoints, pin computer use on only in combination with a default-deny native-app policy and a narrow allow list. Do not rely on the feature pin alone to define safe scope, because a feature pin controls availability, not the identity of allowed apps or the file system material those apps can reveal.

Remote control and appshots should be treated as separate risk surfaces when your client and managed schema expose them as policy-addressable controls. Remote control is the ability for the tool loop to actuate the native UI, so it can type into an editor, click a dialog, or operate a terminal-like surface if that surface is allowed. Appshots are visual state captures used to reason about what is on screen; they can expose code, tickets, credentials mistakenly displayed in a UI, customer names, or internal deployment data. A safe policy does not assume that read-only visual access is harmless.

# Native computer-use policy pattern for requirements.toml
# This is a schema-adaptation template, not a copy-paste guarantee.
# Map each logical field to the exact managed-configuration keys supported
# by your ChatGPT/Codex client version and validate the effective policy.

[requirements.features]
computer_use = "locked_to_admin_policy"
remote_control = "locked_to_admin_policy"
appshots = "locked_to_admin_policy"

[requirements.native_app_use]
default = "deny"
approval_prompts = "required_where_applicable"

# macOS entries should use bundle identifiers, not product names.
[[requirements.native_app_use.allow.macos]]
bundle_identifier = "com.example.AppBundleID"
business_purpose = "Approved development workflow only"

# Windows entries should use AUMIDs for packaged apps or verified executable
# identity fields for desktop apps. Do not rely on display names alone.
[[requirements.native_app_use.allow.windows]]
aumid = "Vendor.AppPackage_family!App"

[[requirements.native_app_use.allow.windows]]
verified_executable_identity = {
  publisher = "Verified Publisher Name",
  product = "Verified Product Name",
  executable = "approved.exe"
}

The template above is intentionally written as a policy pattern rather than a promise about exact key names, because OpenAI’s documentation requires administrators to validate supported keys against the client version they deploy. The security model is the transferable part: lock the feature state, deny by default, allow by durable app identity, keep approvals active, and document the business purpose for every exception. If a proposed allow entry cannot be tied to a named workflow and owner, leave it out of production requirements.

macOS: use bundle identifiers and test helper-app behavior

For macOS, OpenAI’s managed-configuration documentation supports allowing approved applications by bundle identifier. A bundle identifier is the durable identity inside the app bundle, such as the identifier an administrator would inventory through device-management tooling. It is a better policy primitive than the application’s visible name because users can rename apps, and multiple products can have similar names. Before adding an app to the allow list, verify the bundle identifier on a managed host, record the exact application version family you tested, and confirm whether the workflow launches helper apps that require separate handling.

Helper behavior matters because modern macOS applications often delegate work to helper bundles, login items, browser components, terminal shells, language servers, or updater processes. A code editor may open a terminal, a Git client may invoke an external diff tool, and a database client may spawn a browser-based authentication flow. Your policy should not automatically allow every helper just because the parent application is useful. Test the workflow under the default-deny native-app policy and add only the helper identities that are essential, reviewable, and covered by the same risk acceptance.

A safe macOS exception might allow a specific editor bundle for repository changes while denying password managers, personal browsers, cloud-drive sync clients, and release-signing utilities. If the editor needs repository files, grant that through the task’s permission profile and repository scope rather than by allowing broad desktop access. If the workflow requires terminal commands, decide whether the terminal itself is an approved app for that profile; do not let a code-editor exception silently become a general shell exception.

Windows: use AUMIDs or verified executable identities, never display names alone

For Windows, the source documentation and editorial guardrails require stronger identification than a friendly app name. Packaged apps should be identified by their Application User Model ID, commonly shortened to AUMID. Traditional desktop applications should be identified with verified executable identity fields rather than a label such as “Terminal,” “Chrome,” or “Git.” Display names are too easy to duplicate, localize, or confuse across install channels, and they do not provide enough assurance for a managed native-app allow rule.

For Codex Windows Computer Use, How to Set Up Codex Computer Use on Windows — Remote Desktop Automation, Task Scheduling, and Workflow Integration is the most relevant adjacent resource. The Windows computer-use guide covers remote desktop automation, scheduling, and workflow integration, making it directly relevant to platform-specific native-app controls.

# Windows native-app allow-entry evidence checklist
# Store this beside the managed requirements change request.

exception_id = "WIN-NATIVE-APP-004"
host_group = "managed-engineering-windows"
identity_type = "AUMID or verified executable identity"
identity_value = "record value from managed inventory"
install_source = "approved enterprise software channel"
workflow_owner = "engineering productivity owner"
approved_workflow = "edit repository files and run approved local validation"
explicitly_not_allowed = [
  "password-manager UI automation",
  "personal browser profile access",
  "release-signing workflows",
  "unreviewed shell access"
]
review_cadence = "revalidate after app packaging or major-version changes"

Windows policies also need to account for host-specific file and execution surfaces. A desktop app may interact with user-profile folders, corporate sync locations, network drives, WSL distributions, developer certificates, SSH keys, package-manager caches, and IDE credential stores. The native-app allow rule should not be treated as the only boundary. Pair it with permission profiles, deny-read paths, network controls, and approval requirements so that the app can perform the approved task without exposing unrelated local material.

Permission profiles define what the allowed app can touch

A native-app allow list answers “which UI surfaces can Codex operate?” A permission profile answers “what local actions and resources are acceptable for this task?” Those controls should be designed together. A conservative profile might allow viewing an editor and proposing patches while denying command execution and sensitive read paths. A build profile might allow a known terminal or IDE task runner to run project-local tests. A release profile, if allowed at all, should be rare, separately approved, and isolated from signing keys or production deployment credentials unless your organization has a reviewed process for that exact use.

For Codex Permission Profiles, The Complete Guide to Codex Approval Policies — Controlling AI Autonomy in Enterprise Environments is the most relevant adjacent resource. The Codex approval-policy guide explains how autonomy can be bounded by operation type and risk, providing a useful governance model for browser and native-app permission profiles.

Deny-read paths protect secrets even when an app is approved

Deny-read paths are a practical compensating control for native computer use because many useful applications can display or index far more than the task requires. A code editor may show environment files, SSH configuration, package tokens, test data, browser-exported credentials, or workspace-specific secrets. A terminal may read shell history, cloud credentials, Kubernetes configuration, and language-package caches. A policy that allows the app but denies sensitive paths reduces the chance that visual inspection or automation exposes material outside the approved task.

Start with a deny-read baseline that reflects your fleet rather than a generic internet list. Common candidates include SSH key directories, cloud provider credential directories, password-manager exports, browser profile stores, shell history files, package-manager token files, local environment files containing secrets, release-signing locations, customer-data folders, and personal cloud-sync directories. Then add repository-specific exceptions only when the workflow requires them and the data owner has accepted the exposure. If a path contains both source code and secrets, fix the repository hygiene instead of broadening the profile.

# Deny-read design pattern for native computer use
# Adapt path syntax and supported policy keys to the documented schema.

deny_read_intent = [
  "Prevent accidental exposure of user credentials",
  "Prevent native appshots from revealing secret-bearing files",
  "Keep allowed editors and terminals scoped to approved repositories"
]

deny_read_examples = [
  "~/.ssh",
  "~/.aws",
  "~/.config/gcloud",
  "~/.kube",
  "~/Library/Application Support/BrowserProfilesWithSecrets",
  "%USERPROFILE%\\.ssh",
  "%USERPROFILE%\\.aws",
  "%USERPROFILE%\\.kube",
  "%APPDATA%\\CredentialOrTokenStores",
  "repository_paths_containing_release_keys_or_customer_exports"
]

The examples above are not a universal path policy, because operating systems, shell environments, enterprise packaging, and developer tooling differ. On macOS, paths may pass through user Library folders, app containers, symlinks, and TCC-protected locations. On Windows, equivalent data may appear under the user profile, AppData, ProgramData, enterprise sync roots, WSL file systems, or reparse points. Test deny-read behavior on every supported host image, and include symlink, shortcut, WSL, and network-drive cases in the acceptance test.

OS permissions are separate from managed requirements

Managed requirements constrain Codex behavior where the client supports the relevant keys, but they do not replace operating-system permission models. On macOS, screen capture, accessibility, automation, full-disk access, files-and-folders access, and related privacy controls are enforced outside requirements.toml. On Windows, UAC boundaries, enterprise endpoint controls, application control policies, profile permissions, and file ACLs remain separate layers. If the OS denies access, an app allow rule should not be expected to make the workflow succeed. If the OS grants broad access, a managed policy is still needed to prevent Codex from using that broad access outside the approved profile.

This separation is useful for incident response because it creates independent evidence streams. Endpoint-management inventory can show which application identities and OS permissions were present. Codex managed configuration can show what the administrator intended to require. OpenAI’s safety materials also describe telemetry and compliance-log concepts for enterprise contexts, while partner runtime tools may add detection and response layers where deployed. Do not collapse these into one control plane; use them to cross-check each other when validating a rollout or investigating an unexpected action.

Safe exceptions: approve workflows, not convenience

A safe native-app exception has five properties: a verified app identity, a named workflow owner, a narrow permission profile, deny-read coverage for unrelated secrets, and a test case that demonstrates both allowed and denied behavior. For example, an engineering team may justify allowing a specific editor bundle or verified executable to modify files inside an approved repository. That exception should not automatically allow a personal browser, a password manager, a deployment console, a database GUI, or an unrestricted terminal. Each additional app changes the threat model and should go through the same review.

Use staged rollout for exceptions that touch terminals, database clients, cloud consoles, deployment tools, or anything capable of moving data out of the workstation. Begin with a small host group, collect effective-policy evidence, reproduce the approved workflow, verify blocked apps remain blocked, and confirm that approval prompts still appear where required. Then test negative cases: attempt to open a denied app, read a denied path, use an unapproved helper, import browser data, or operate outside the repository. A rollout is not complete until the negative cases fail in the way your runbook expects.

Host-specific sandbox differences must be part of acceptance testing

Do not assume a policy that behaves correctly on one laptop image will behave identically across macOS, Windows, VDI, developer workstations, and managed build desktops. Application identity systems differ, path syntax differs, helper-process behavior differs, and enterprise security tools may inject prompts or wrappers that change the visible workflow. OpenAI’s model is to provide managed controls and sandbox boundaries, but the effective result is still host-specific. Treat each host family as its own acceptance target.

The minimum acceptance matrix should include macOS on the supported enterprise image, Windows packaged-app cases using AUMIDs, Windows desktop-app cases using verified executable identities, and any virtualized or remote workstation environment where Codex is permitted. For each host family, test feature pins, native-app default-deny behavior, approved app launch, denied app launch, remote-control behavior if enabled, appshot exposure, deny-read paths, approval prompts, and OS-permission failures. Record the client version in the test evidence because newer managed-configuration keys must be validated against client support before they become security assumptions.

# Native computer-use rollout gate

gate_1_client_support = "document client version and supported managed keys"
gate_2_feature_pins = "computer use, remote control, and appshots locked as intended"
gate_3_default_deny = "unlisted native apps cannot be operated"
gate_4_identity_allow = "macOS bundle IDs and Windows AUMIDs/verified identities match inventory"
gate_5_permission_profile = "approved app can touch only the intended task scope"
gate_6_deny_read = "secret-bearing paths fail closed in positive and negative tests"
gate_7_os_permissions = "required OS permissions are separately approved and audited"
gate_8_approvals = "allow rules do not suppress required review prompts"
gate_9_host_variance = "macOS, Windows, VDI, WSL, and managed images tested where applicable"
gate_10_evidence = "effective policy and test results attached to the change record"

The production posture is conservative by design: enable native computer use only where the business value is clear, identify applications with platform-appropriate durable identities, keep permission profiles narrow, deny sensitive reads, and test on the actual host classes your users run. That approach aligns with OpenAI’s stated distinction between administrator-enforced requirements and user-changeable defaults, and it preserves the key safety property of Codex computer use: low-risk actions can proceed inside bounded environments, while higher-risk actions remain blocked or subject to review.

Rollout Plan: Prove the Effective Policy Before You Enforce It

A Codex browser and computer-use lockdown should move through three enforcement planes before broad deployment: system requirements on the endpoint, cloud-managed requirements from the workspace administration layer, and MDM-delivered requirements or managed preferences where supported. OpenAI’s managed-configuration documentation distinguishes administrator-enforced requirements from managed defaults, so the rollout decision is not “did the file deploy?” but “can the user weaken the runtime setting during a run?” Treat any setting that protects uploads, downloads, browser history, approval persistence, full Chrome DevTools Protocol access, automatic review, browser origins, or native applications as a requirement unless your risk assessment explicitly accepts user override.

Start with a lab cohort that includes every supported endpoint class: a clean macOS device, a macOS device with existing managed preferences, a Windows device with the approved native applications installed, and at least one machine with an older Codex client that you expect to block or upgrade. OpenAI’s documentation warns that policy support depends on client behavior and documented merge rules, and the release notes add newer granular browser and native-app controls; therefore, a client-version inventory is a deployment prerequisite rather than an administrative nicety.

Stage 1: Establish the system requirement baseline

The first stage should install the strictest local requirement set on a small number of test machines. Use it to confirm default-deny browser behavior, blocked uploads, blocked downloads unless explicitly allowed, no browser-history access, no persistent approvals, no full CDP access, disabled automatic review where your policy requires manual review, and native-app denial except for identified approved applications. This stage proves that the endpoint can enforce a restrictive posture without relying on workspace membership, repository permissions, network reachability, or operating-system prompts.

Recommended rollout record, not a product schema:

Policy name: codex-browser-computer-use-baseline
Enforcement plane tested: system requirements
Client versions tested: record exact Codex desktop or CLI versions
Browser default: deny unless origin exception exists
Uploads: denied except approved test exception
Downloads: denied except approved test exception
History access: denied
Persistent approvals: denied
Full CDP access: denied
Automatic review: disabled where human approval is required
Native apps: deny by default; allow only verified identities
Evidence owner: security engineering
Rollback owner: endpoint management team
Expiration for pilot exception: 14 days

This record is deliberately separate from the requirements file because production evidence should remain understandable to auditors who do not read TOML. Keep the deployed file hash, MDM profile identifier if used, cloud policy version, and test results together in the change ticket so that a later incident review can distinguish “policy was not present” from “policy was present but an exception was too broad.”

Stage 2: Add cloud-managed requirements and verify merge behavior

After the local baseline works, apply the corresponding cloud-managed requirements to a pilot group. OpenAI documents a policy stack that can include system requirements, cloud-managed requirements, legacy managed configuration, and macOS managed preferences, with higher-precedence sources taking priority according to documented merge behavior. Your test plan must therefore include a conflict case: set a stricter local requirement and a less strict cloud-managed value, then verify that the effective runtime policy follows the documented precedence rather than the administrator’s expectation.

Do not use managed defaults as substitutes for requirements in this phase. A managed default can be reapplied at restart, but OpenAI’s documentation describes defaults as initial values that users may change during a run. Defaults are useful for convenience settings and low-risk starting posture; they are not adequate for upload bans, download bans, app-deny behavior, approval lifetimes, or full developer-access restrictions when those controls are part of your security boundary.

Stage 3: Deliver MDM requirements and managed preferences where applicable

Use MDM to make the policy durable on managed endpoints, especially macOS fleets where managed preferences may participate in the policy stack. The MDM stage should test installation, update, removal, and reinstallation, not only the happy path. If a user can uninstall a profile, downgrade a client, move to an unmanaged desktop, or run an unapproved binary outside the expected device channel, the policy is not a fleet control; it is only a configured preference on cooperating machines.

For Windows native-app rules, do not accept display names in your MDM inventory as proof of allow-list correctness. The source guidance for this playbook requires verified identities such as AUMIDs or verified executable identity fields rather than names alone. A display name can be ambiguous, localized, or changed by packaging; the acceptance test must show that the exact installed application identity is allowed and that a similarly named unapproved executable remains blocked.

Fleet-Version Gate: Block Rollout Until Support Is Proven

Create a fleet report that lists each Codex client version, operating system version, policy source, and last successful policy-evidence timestamp. The report does not need to expose user content; it needs to answer whether the endpoint is capable of enforcing the specific keys you plan to use. OpenAI’s Work and Codex documentation separately notes version dependencies for new model access, and the same operational principle applies here: newer managed-configuration keys should not be deployed blindly to clients that have not demonstrated support.

Representative Acceptance Tests: Allowed, Blocked, and Still-Reviewed

Run acceptance tests with disposable accounts, synthetic repositories, and non-sensitive files. The goal is to prove the control boundary, not to test against production secrets. Each test should record the user, device, client version, policy version, expected result, observed result, screenshots or terminal output where appropriate, and whether OpenTelemetry or compliance logs captured the relevant activity according to your enterprise logging configuration.

Operational rule: an allow rule proves only that a policy no longer blocks that origin or application. It does not install software, grant workspace access, override network denies, bypass approval prompts, or grant operating-system permissions.

Effective-Policy Evidence and Audit Trail

For each production profile, store four forms of evidence: the intended policy document approved by change control, the delivered artifact or cloud policy version, the endpoint receipt showing that the device received it, and behavioral proof from allowed and blocked tests. If the client exposes an effective-policy view or diagnostic output, capture it; if not, use behavior tests, file hashes, MDM receipts, and administrative policy records as the minimum evidentiary set.

For Codex Security Audit Logs, 3 Enterprise Security Checks Before Deploying ChatGPT Work — Data Governance, Access Control, and Audit Compliance is the most relevant adjacent resource. The enterprise security-check guide emphasizes audit compliance and access evidence, reinforcing the need to verify effective policy and retain decision records.

Rollback, Change Control, and Quarterly Recertification

Rollback must be tested before enforcement, because a broken browser-origin rule can stop engineers from reaching approved work systems while a broken native-app rule can block required local tooling. Maintain a previous known-good requirements profile, its deployment instructions, and a named approver who can authorize emergency restoration. If a rollback relaxes a security-sensitive requirement, limit it by group, device tag, or time window and open a follow-up risk ticket immediately.

Use standard change control for every exception. A production exception request should identify the business workflow, exact origin or application identity, data types involved, upload and download needs, approval duration, whether automatic review is acceptable, the owner, the expiration date, and the test evidence proving that adjacent unapproved actions remain blocked. Reject requests that describe only convenience, broad categories, or display names such as “all browsers,” “developer tools,” or “finance apps.”

Run quarterly recertification against both inventory and behavior. Inventory review confirms that allowed origins still belong to the business, macOS bundle identifiers and Windows verified identities still match approved software, and pilot-only exceptions have expired. Behavioral recertification repeats the representative allowed and blocked tests on current client versions, because a fleet upgrade, application repackaging, or policy-stack change can alter the effective result even when the approved document did not change.

Incident Response When a Policy Boundary Fails

If Codex browser or computer use reaches an unapproved site, uploads a file contrary to policy, downloads into an unexpected location, accesses browser history, persists an approval too long, or launches an unapproved application, handle it as a control failure until proven otherwise. The first responder should preserve the device state, policy artifacts, MDM receipts, cloud policy version, compliance logs, and OpenTelemetry traces before changing the policy, because remediation can destroy the evidence needed to determine root cause.

1. Contain: move affected users or devices to the strict baseline profile, revoke the specific exception, or disable the risky feature pin where that is the approved emergency action.
2. Preserve: capture policy files, hashes, deployment timestamps, client versions, user group membership, and relevant audit logs.
3. Scope: search for the same policy version, origin, application identity, approval duration, or client version across the fleet.
4. Eradicate: remove broad exceptions, upgrade unsupported clients, correct MDM targeting, or repair cloud policy precedence issues.
5. Recover: redeploy the corrected requirements, rerun blocked and allowed tests, and document restored effective policy.
6. Review: update the exception workflow, quarterly test set, and change-control template so the same failure mode is caught earlier.

Production Checklist

• Confirm every targeted browser and native-app control is enforced as a requirement, not merely a managed default.
• Inventory Codex client versions and block enforcement rollout for clients that have not demonstrated support for the relevant keys.
• Test system requirements, cloud-managed requirements, and MDM-delivered policy independently before testing combined precedence.
• Use default-deny browser origins with explicit exceptions for approved work surfaces.
• Keep upload and download exceptions separate from origin access, because a site allow rule should not imply file-transfer approval.
• Disable browser-history access, persistent approvals, full CDP access, and automatic review where those capabilities exceed the workflow risk level.
• Allow native applications by macOS bundle identifier or Windows verified identity, not by display name.
• Retain effective-policy evidence: approved change, deployed artifact, endpoint receipt, and behavior-test results.
• Configure OpenTelemetry export and compliance-log review according to enterprise policy, and verify that security teams know where to retrieve the evidence.
• Test rollback, assign emergency approvers, and time-limit any rollback that relaxes requirements.
• Recertify origins, application identities, feature pins, and approval durations quarterly.
• Route every exception through change control with owner, expiration, data classification, and representative blocked tests.

Failure-Mode Table

Useful Links

• OpenAI: Managed configuration for enterprise requirements and defaults
• OpenAI: Product release notes
• OpenAI: Running Codex safely