Control level
| What | Level |
|---|---|
| Agent actions | Advisory. Govern compiles managed hooks for Codex, but enforcement through them has not yet been verified against a released Codex CLI that runs managed hooks and honours a deny. |
Hard constraints in requirements.toml | Applied by Codex; users cannot override them |
| Model traffic | Network: holds while Codex sends requests to the gateway |
Treat Codex as advisory for actions that only the hook can stop, until the verification is recorded.
1. Write the policy and enrol the machine
Write rules in Agent policy (Agent policy) and enrol the machine with the endpoint agent (Deploy). The agent fetches the policy compiled for the codex engine and installs three files:
| File | Contents |
|---|---|
/etc/codex/requirements.toml | Hard constraints: allowed approval policies and sandbox modes, allow_managed_hooks_only = true, managed hooks (the enforcement hook and approved hooks), and [[rules.prefix_rules]] for shell deny (forbidden) and ask (prompt) rules |
/etc/codex/config.toml | approval_policy, sandbox_mode, [sandbox_workspace_write] network_access |
/etc/codex/rules/keystone.rules | Shell allow rules as prefix_rule(..., decision = "allow") |
2. How the policy maps
| Policy | Codex |
|---|---|
Shell default allow / ask / deny | approval_policy on-request / untrusted / untrusted |
Shell allow rules | Codex runs an allowed command outside its sandbox, so each allow rule is a gap while the sandbox limits writes or network |
Shell pattern tok tok * | A prefix rule with those tokens |
file_write default deny with no write allow rule | sandbox_mode = "read-only"; otherwise workspace-write (never danger-full-access) |
| File path rules | Not expressible: gap |
network default allow with no network deny or ask rule | network_access = true; otherwise false |
| Git, package, MCP tool and model rules | Not expressible: gap |
A developer's own exec rules (~/.codex/rules) can allow commands no organisation rule matches. The strictest rule wins, so they cannot loosen an organisation prompt or forbidden. Codex has no Notification hook event.
Check the gaps on Agent policy > Policy preview with the engine codex.
3. Route model traffic through the gateway
Add the provider to ~/.codex/config.toml:
model_provider = "keystone"
[model_providers.keystone]
name = "Keystone Model Access"
base_url = "<your API URL>/api/v1/models/gateway/v1"
env_key = "KEYSTONE_GATEWAY_TOKEN"
wire_api = "responses"Start Codex with a fresh token:
export KEYSTONE_GATEWAY_TOKEN="$(keystone-cli token models --tool codex)"
codexCodex reads the token when it starts, so a session longer than the token's hour needs a restart. Pick a model you may use from GET <your API URL>/api/v1/models/gateway/v1/models.
Audit
Codex can push OpenTelemetry events to Govern's vendor audit receiver; see Evidence. Policy decisions reported by the endpoint agent are in Agent decisions.