Power Your Software Testing with AI Agents and Cloud
The Native AI-Agentic Cloud Platform to Supercharge Quality Engineering. Test Intelligently and Ship Faster.
- TestMu AI (Formerly LambdaTest)
- /
- Blog
- /
- Codex Auto-review Explained: What It Checks and What It Misses
Codex Auto-review Explained: What It Checks, How to Turn It On, and What It Misses
How Codex Auto-review works, how to turn it on, how it differs from Codex code review, and the outcome check it leaves to you before release.
Published on:
Short answer: Codex Auto-review decides whether a coding agent is permitted to run a risky command. Agent Assurance ensures that the finished workflow has left your systems in the correct state.
The first of these is a permission check which happens during the run. The second is an independent check of the outcome prior to release. Any team that's shipping agents into production needs both of these.
In October 2026, OpenAI made Auto-review free for anyone using Codex with a ChatGPT account. That's good news. Fewer approval pop-ups means agents can run longer tasks without a human having to be on hand to babysit every escalation.
It also raises a very valid question for anyone putting agents up against real systems: if one agent is already looking at another, what is left to check? Turns out there's quite a bit left to check.
Approval simply tells you that the action looked OK at the time it was requested. It gives you no indication whatsoever as to whether the run did the right thing.
TL;DR
Codex Auto-review is a Codex permission mode that routes each request to cross the sandbox boundary to a separate reviewer agent instead of a human. It exists so long-running coding agents can keep working without someone approving every escalation, and it judges one action at a time, not what the finished run changed.
Codex Auto-review at a Glance
- Reviewer agent: Replaces the human approver: Yes. A separate Codex reviewer agent approves or denies each request to cross the sandbox boundary, and OpenAI's Alignment research reports that Codex sessions stop for human approval roughly 200x less often than in manual approval mode.
- codex-auto-review model: Counts toward ChatGPT plan limits: No. OpenAI's help center says auto-review safety checks are free and don't count toward your plan's usage limits when you're signed in with a ChatGPT account, while other Codex activity still does. Tracking that is covered in Codex usage.
- Default permissions vs Auto-review: Widens the sandbox: No. Auto-review keeps the same writable roots, network limits and protected paths as the default Ask for approval mode. It only changes who reviews requests to cross that boundary, so with
approval_policy = "never"or full access there is nothing for it to review. - Codex CLI auto review: One setting turns it on: No. The Codex CLI needs
approvals_reviewer = "auto_review"plus an interactive approval policy such asapproval_policy = "on-request". Changing the approval policy alone does not select the reviewer. - Independent verification: Auto-review is independent of Codex: No. The reviewer is itself a Codex agent judging a Codex agent, the same limit that applies to AI guardrails built by the agent's own vendor. Evidence for AI agent governance and audits has to come from a check outside that loop.
- TestMu AI Agent Assurance: Runs from Codex CLI: Yes. Agent Assurance checks what a finished agent workflow changed before release, and the rook skill (
npx @testmuai/rook-skill@latest install --agent codex) lets Codex CLI drive it. The docs explain how to use Rook with Codex CLI.
What Is Codex Auto-review?
Codex Auto-review is a Codex permission mode in which a separate reviewer agent (rather than a human) is the one who approves or rejects requests to cross the sandbox boundary. As per OpenAI's documentation, the primary agent stays exactly where it is with the same sandbox and same limits; it's just the reviewer that changes.
It triggers on four kinds of requests:
- Shell commands that ask for escalated sandbox permissions
- Network requests the sandbox would block
- File edits outside the allowed writable folders
- MCP or app tool calls configured to need approval
The reviewer itself is a Codex agent. It sees the compact transcript and the exact request and then approves or denies with a reason.
It's built to stop things like sending secrets to untrusted destinations, probing for credentials, weakening security settings, and the like (actions which are very hard to undo). If it's denied repeatedly in a single turn, a circuit breaker will kick in and stop the agent from looping.
How to Turn On Codex Auto-review
Per OpenAI's docs:
- Desktop app: under the composer in the permissions control, select 'Approve for me' and make sure it's ticked for the current chat.
- CLI or config file: set
approvals_reviewer = "auto_review"in conjunction with an interactive approval policy such asapproval_policy = "on-request". Simply changing the approval policy will not turn the reviewer on. - Organisations: managed requirements take priority over local settings so an admin policy can enable, restrict or customise the reviewer.
Auto-review has nothing to review in the scenario where approvals are set to 'never' or where the agent is running with full access (as no approval request is ever going to be generated). The only way to turn it off would be to go back and change the permissions to manual approval or remove the reviewer entirely.
Auto-review vs Codex Code Review
The names are easy to confuse. Auto-review is the one that approves an agent's actions as it's running, at the sandbox boundary.
Codex code review is the one that reviews pull requests on GitHub once Codex is connected to the repo and automatic reviews are turned on (docs).
One deals with actions, the other with code. Neither of them actually checks what a completed agent workflow has changed in your systems.
What Auto-review Doesn't Check
OpenAI is very clear about the limitations. Auto-review is not a deterministic security guarantee and must be used in conjunction with sandbox design, monitoring and policy rather than as a replacement for it. Three gaps are particularly important for teams that are shipping agents.
1. Actions which never ask for permission. Auto-review doesn't run on the actions the sandbox already permits. An agent can make a hundred edits which are all permissible and individually harmless, and yet collectively wrong. None of those actions will get to the reviewer.
2. Outcomes. The reviewer assesses the outcome of a single proposed action. It doesn't look at the state of the entire run afterwards: whether the right records have been updated, whether the data still all reconciles, whether the downstream system has got what it was expecting.
3. Independence. The reviewer is a Codex agent reviewing a Codex agent. That's the sensible default for convenience, but it's not an independent check (which is why it matters for audits).
None of that is a flaw in Auto-review. It's just the scope of a permission system. Permission is not proof.
What Is Agent Assurance?
Agent Assurance (from TestMu AI) covers the bit that Auto-review leaves open. Prior to a workflow going live, Rook's test agents run it end to end and check the state that it leaves behind against deterministic specs, regardless of what model or coding agent was used to build it.
Where Auto-review asks "may this command run?", Agent Assurance asks "did this workflow leave the systems in the right state?" The specs come from the material you already have (Jira tickets, documents, recordings, etc.) so the pass/fail is predetermined rather than being a judgement call by a model.
Codex Auto-review vs Agent Assurance
| Codex Auto-review | Agent Assurance by TestMu AI | |
|---|---|---|
| Question it answers | May this command run? | Did the workflow leave systems in the right state? |
| When it acts | During the run, at the sandbox boundary | Before release, across whole runs |
| What it inspects | One approval request plus a compact transcript | The end state against the spec: records, data, connected systems |
| Who checks | A second Codex agent | Deterministic specs, independent of the agent's model vendor |
| Model coverage | Codex | Any model, any agent framework |
| Verdict | Allow or deny | Pass or fail against the spec |
| Evidence | Codex session logs | Your control plane |
| Best for | Keeping long coding sessions moving safely | Deciding whether an agent workflow ships |
How to Run Both
Treat them as two layers, not two options.
- During the run: keep Auto-review on so that any risky escalations get a quick second look without you having to stop.
- On the code: if the run produced code, then test the code in the normal way. Kane CLI takes care of that for SDETs and developers.
- On the effects: if the run had any impact other than on the repo (i.e. a data migration, a config, a ticket, a deployment) then you must verify that end state with Agent Assurance prior to release.
Keep your guardrails. Add assurance.
Conclusion
Auto-review makes long Codex sessions safer and faster, and now that it's free, there's little reason not to turn it on. But it answers a narrow question: whether one action may cross the sandbox boundary.
It never sees the hundred permitted edits that add up to the wrong result, and it never checks what the finished run changed in your systems. Permission is not proof.
Agent Assurance supplies the proof, verifying the end state of every workflow against deterministic specs before it ships, whichever model or coding agent built it.
Author
Jay Singh
Blogs: 4
Jay Singh is the Co-Founder and Chief Customer Officer at TestMu AI, with over two decades of experience in sales, customer success, and growth strategy. He has been leading customer initiatives at TestMu AI for more than 8 years, helping scale the platform to serve a global user base. Jay is followed by 15,000+ professionals on LinkedIn, reflecting his influence across the software testing and quality assurance industry. Before TestMu AI, he founded BusinessMojos, later acquired by DAMO Consulting, and VisualMojos Technologies. He also held senior roles at LeadSquared and Harman International.
Reviewer
Maneesh Sharma
Reviewer
Maneesh Sharma is Chief Operating Officer at TestMu AI, where he leads the company's revenue functions across go-to-market, sales, RevOps, customer success, and the partner ecosystem, driving its global expansion. He brings over 28 years of experience across product, go-to-market, and business operations. Before TestMu AI he was Managing Director and General Manager for GitHub across India and APAC, Head of Partner Sales and Ecosystem at Adobe, Chief Revenue Officer at WizIQ, and Head of Products and Solutions at SAP India. Maneesh holds an MBA from IIM Bangalore and a B.E. in Electronics and Communications from NIT Surat.
Codex Auto-review FAQs
Did you find this page helpful?
More Related Blogs
TestMu AI forEnterprise
Get access to solutions built on Enterprise
grade security, privacy, & compliance
- Advanced access controls
- Advanced data retention rules
- Advanced Local Testing
- Premium Support options
- Early access to beta features
- Private Slack Channel
- Unlimited Manual Accessibility DevTools Tests