I don’t use Codex, and I’m not a pro, but I’m currently building a filesystem layer that routes all operations through a fixed, deterministic control point — essentially a constrained server node or function that only allows access to predefined paths.
I’m still working on it, but the underlying issue here feels quite clear. AI systems are inherently non-deterministic, so letting them directly perform write or delete operations on a filesystem is risky by design — you’re effectively exposing your system to the model’s loss function.
Read-only operations (like checking disk usage, file sizes, or permissions) seem far less problematic, but anything that mutates state — writes, deletes, moves — really needs strict boundaries and validation.
Separation between “decision-making” (AI) and “execution” (controlled layer) feels critical here.
I guess if you ‘feel it in your bones’…
