Codex, Behind the Harness — Dominik Kundel, OpenAI

An agent's surrounding software has to decide whether a proposed action fits the user's authorization. In Dominik Kundel's account of OpenAI's Codex, an escalation triggers a separate reviewer with read-only access. That reviewer considers the conversation and how explicitly the user requested the action, as described in the presentation.

Deleting a file the user named and deleting an unmentioned repository-history folder can therefore receive different treatment. The design places an authorization check between the model's proposed action and execution. It addresses the burden of repeated approvals through contextual review, without making the reviewer another unrestricted actor.

“Once GPT 5.3 Codex Spark started serving a thousand tokens per second on Cerebras, inference stopped being the bottleneck and the network became it.”

“Tools can be marked deferred so they never enter the context window and surface through tool search when the model actually wants them, and the available skills list is capped at 2% of the context window, with descriptions trimmed as it grows past that.”

“Approval fatigue pushes people into full access, which their own security team hates, so an escalation now spins up an auto review subagent with read only permissions and no ability to spawn others, judging the action against the transcript and how explicitly the user authorized it.”

“Deleting a file you asked for reads differently from deleting a .git folder you never mentioned.”