---
title: "Govern OpenAI Codex CLI"
---

# Govern OpenAI Codex CLI

Compile Neural Inverse Govern agent policy into Codex's requirements, config and rules files, understand what is still advisory, and route Codex model traffic through the gateway.

## Control level

| What | Level |
|---|---|
| Agent actions | **Advisory**. Govern compiles managed hooks for Codex, but enforcement through them has not yet been verified against a released Codex CLI that runs managed hooks and honours a deny. |
| Hard constraints in `requirements.toml` | Applied by Codex; users cannot override them |
| Model traffic | **Network**: holds while Codex sends requests to the gateway |

Treat Codex as advisory for actions that only the hook can stop, until the verification is recorded.

## 1. Write the policy and enrol the machine

Write rules in **Agent policy** ([Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)) and enrol the machine with the endpoint agent ([Deploy](https://neuralinverse.com/docs/deploy/)). The agent fetches the policy compiled for the `codex` engine and installs three files:

| File | Contents |
|---|---|
| `/etc/codex/requirements.toml` | Hard constraints: allowed approval policies and sandbox modes, `allow_managed_hooks_only = true`, managed hooks (the enforcement hook and approved hooks), and `[[rules.prefix_rules]]` for shell `deny` (`forbidden`) and `ask` (`prompt`) rules |
| `/etc/codex/config.toml` | `approval_policy`, `sandbox_mode`, `[sandbox_workspace_write] network_access` |
| `/etc/codex/rules/keystone.rules` | Shell `allow` rules as `prefix_rule(..., decision = "allow")` |

## 2. How the policy maps

| Policy | Codex |
|---|---|
| Shell default `allow` / `ask` / `deny` | `approval_policy` `on-request` / `untrusted` / `untrusted` |
| Shell `allow` rules | Codex runs an allowed command outside its sandbox, so each allow rule is a gap while the sandbox limits writes or network |
| Shell pattern `tok tok *` | A prefix rule with those tokens |
| `file_write` default `deny` with no write allow rule | `sandbox_mode = "read-only"`; otherwise `workspace-write` (never `danger-full-access`) |
| File path rules | Not expressible: gap |
| `network` default `allow` with no network deny or ask rule | `network_access = true`; otherwise `false` |
| Git, package, MCP tool and model rules | Not expressible: gap |

A developer's own exec rules (`~/.codex/rules`) can allow commands no organisation rule matches. The strictest rule wins, so they cannot loosen an organisation `prompt` or `forbidden`. Codex has no `Notification` hook event.

Check the gaps on **Agent policy > Policy preview** with the engine `codex`.

## 3. Route model traffic through the gateway

Add the provider to `~/.codex/config.toml`:

```toml
model_provider = "keystone"

[model_providers.keystone]
name = "Keystone Model Access"
base_url = "<your API URL>/api/v1/models/gateway/v1"
env_key = "KEYSTONE_GATEWAY_TOKEN"
wire_api = "responses"
```

Start Codex with a fresh token:

```bash
export KEYSTONE_GATEWAY_TOKEN="$(keystone-cli token models --tool codex)"
codex
```

Codex reads the token when it starts, so a session longer than the token's hour needs a restart. Pick a model you may use from `GET <your API URL>/api/v1/models/gateway/v1/models`.

## Audit

Codex can push OpenTelemetry events to Govern's vendor audit receiver; see [Evidence](https://neuralinverse.com/docs/evidence/). Policy decisions reported by the endpoint agent are in **Agent decisions**.