Building a safe, effective sandbox to enable Codex on Windows

When OpenAI joined the Codex engineering team, Codex for Windows lacked a sandbox implementation. This forced Windows users to choose between approving nearly every command or enabling Full Access mode, which removed friction at the expense of oversight. Codex runs with the permissions of a real user by default, managing a conversation between a human and a cloud-based model to handle tasks like running tests, reading or editing files, and creating Git branches. To balance effectiveness and safety, Codex attempts to read files almost anywhere while restricting writes to the user workspace without internet access unless specified. While operating systems like macOS and Linux provide native isolation utilities, Windows does not offer this out of the box. OpenAI evaluated several native Windows isolation tools including AppContainer, Windows Sandbox, and Mandatory Integrity Control labeling. AppContainer was too tightly scoped for open-ended developer workflows, Windows Sandbox required a separate throwaway desktop and was unavailable on Windows Home SKUs, and integrity labels broadly altered the host filesystem's trust model. Finding these options unsuitable, OpenAI designed a custom unelevated solution using synthetic security identifiers (SIDs) and write-restricted tokens. By creating a synthetic sandbox-write SID and assigning it to a write-restricted process token, the team successfully controlled filesystem write access for Codex without requiring administrator privileges.