There is also the rules mechanism. This is probably the setting you want to look into.
Rules let you allow, prompt, or forbid specific command prefixes when they need to run outside the sandbox.
Official docs: Rules – Codex | OpenAI Developers
Example:
# ~/.codex/rules/default.rules
prefix_rule(
pattern = ["gh", "pr", "view"],
decision = "allow",
justification = "Read-only GitHub PR inspection is allowed outside the sandbox.",
)
According to the docs, decision = “allow” means Codex can run the matching command outside the sandbox without prompting.
Rules are prefix-based and evaluated conservatively. If multiple rules match, the most restrictive result wins.
You can test a rule with:
codex execpolicy check --pretty --rules ~/.codex/rules/default.rules -- gh pr view 7888 --json title,body,comments
Rules are experimental.
Ps. I personally prefer the low involvement auto-review as I haven’t encountered any issues besides the observations you mentioned.