The Approval Gate Is Becoming an Agent: Inside the Auto-Review Architecture

On September 29, 2026, OpenAI shipped dots: always-on agents powered by GPT-6 Astra, each with its own cloud computer and browser. The launch also documented Auto-review, a separate reviewer agent positioned between an acting agent and consequential actions—in dots and the Codex harness. For engineers building production agent systems, the important development is the architecture, not the product surface: a reviewer that cannot grant itself new permissions, explicit denial semantics, human handoffs, and monitoring that can pause work asynchronously. This analysis is derived from OpenAI’s launch posts and public documentation, all fetched on 2026-10-04 — we did not use dots or run the Codex auto-review flow.

How This Guide Was Built

This guide is a documentation-only analysis of OpenAI’s public materials, including the dots launch post, safety and privacy overview, dots help article, Codex Auto-review documentation, agent approvals and security documentation, DevDay recap, Anthropic’s Sonnet 5.5 announcement, and the Agents API overview. No hands-on testing occurred: no dots were used, no Auto-review flow was run, and no harness was instrumented.

What Dots Changed About the Approval Problem

Dots change the approval problem by making agent work continuous and connected to real services, according to OpenAI’s launch post. They connect to 4,000+ apps through plugins and are reachable through ChatGPT desktop, web, mobile, Slack, Teams, and voice. Pro access excludes the EEA, Switzerland, and UK; Enterprise, Edu, and Healthcare beta is off until a workspace admin enables it.

Each dot runs in its own cloud workspace. OpenAI maintains the Linux OS and Chrome; sandboxing restricts code and tool access, and users’ environments are isolated. The key trust-boundary statement is: “Dots run code in environments that are separate from the systems that coordinate their work and enforce key safeguards. They can create files and run tools there, but they cannot use that access to change those safety systems or turn off required checks.” See the safety overview and dots help documentation. Local computer access is opt-in, off by default, performed in separate sidebar tasks, and stopped when access is revoked. The sandbox boundary it enforces — the isolation tiers an agent actually runs inside — is the deeper design surface we examined in our analysis of sandboxing tiers for agent code execution.

The Four Separations That Make Auto-Review a Reference Architecture

Auto-review is a reference architecture because the Codex documentation separates the acting agent, enforcement, review timing, and human-only decisions. Copy the boundaries, not just the reviewer prompt: each boundary should be enforced by a component the acting agent cannot rewrite, and each handoff should have a defined destination and outcome.

The separation map (four lanes, described for the figure): Four boxes or lanes: acting agent vs. reviewer agent, with proposed consequential actions crossing to the reviewer; enforcement and policy vs. agent-changeable environment, with attempts to expand access stopped at the boundary; action-level pre-execution review vs. task-level asynchronous monitoring, marking the action gate before execution and the monitor’s pause signal at task scope; and machine decisions vs. human-only classes, marking sensitive actions as handoffs to a person rather than reviewer approvals. The security documentation describes the sandbox and approval-policy split.

The first separation prevents the acting agent from being sole judge of its own risky action. This is the automated successor to the durable human-in-the-loop approval gates we examined earlier: the gate is the same, but the decision-maker is now a reviewer agent rather than a person. The second puts enforcement outside its reach. The third distinguishes “may this action run?” from “should this task continue?” The fourth accepts that some decisions should not be automated: changing a password, for example, stays with the user. These are distinct controls, not interchangeable checks. None of these separations assumes the agent’s inputs are benign: tool-using agents remain exposed to prompt-injection attacks, which is why the reviewer inspects the proposed action rather than trusting the agent’s stated intent.

The Codex Mechanics: Triggers, Reviewer Context, and What the Reviewer Sees

Codex Auto-review evaluates boundary-crossing requests without expanding the agent’s permissions, according to the mechanics documentation. Triggers are escalated shell or exec calls; network requests blocked by sandbox or policy; file edits outside writable roots; MCP or app calls requiring approval; and Computer Use access to a new website or domain. Routine in-sandbox actions are not reviewed.

The reviewer gets a compact transcript and exact approval request: user messages, surfaced assistant updates, relevant tool calls and outputs, and the proposed action. It may perform rare read-only checks. “Hidden assistant reasoning is not included.” Computer Use app approvals still surface to the user. The main Codex agent remains in the same sandbox, under the same approval policy and network and filesystem limits; Auto-review “does not expand writable_roots, enable network access, or weaken protected paths.” See Auto-review and agent security.

Denial Semantics: Why a Rejection Is Not an Ordinary Error

A denial is a control instruction, not a retryable tool failure, under Codex Auto-review’s denial contract. The rationale returns to the acting agent with a stronger directive: do not pursue the same outcome through a workaround, indirect execution, or policy circumvention. Continue only with a materially safer alternative; otherwise stop and ask the user.

Dots can respond to a blocked step by seeking information or approval, submitting again, choosing a permitted alternative, handing a sensitive step back to the user, or stopping. Approval cannot override core safety requirements. Read-only actions follow app permissions but skip this extra review, and some sensitive actions always remain with the user, as described in the dots safety overview and help article.

Circuit Breakers and the Denial-Loop Problem

The current open-source Codex implementation trips its breaker after 3 consecutive denials OR 10 denials within a rolling window of the last 50 reviews in the same turn, according to the Auto-review documentation. Any non-denial resets the consecutive counter. A trip produces a warning and aborts the turn; these thresholds describe the current implementation, not a permanent product specification.

This bounds repeated attempts to negotiate around a refusal. Timeouts are surfaced separately from denials: a timeout alone is not proof that an action is unsafe. Harness builders should preserve that distinction in logs and control flow rather than converting every unavailable judgment into a policy rejection.

The Override Path: Scoped, Single-Retry, Still Reviewable

Codex provides a narrow override path rather than a blanket bypass, as detailed in the Auto-review documentation. /approve opens an Auto-review Denials picker containing one recent denied action. Approval authorizes one retry, scoped to the exact action, not similar future actions; that retry still goes through Auto-review, which can deny it again if policy says the user cannot override that denial class.

For harness design, the useful property is that authorization is attached to a specific request, not converted into a lasting permission. The product also states that user approval cannot override core safety requirements. See dots help and the Codex approval documentation.

Policy Lives Outside the Agent — and Never Merges

Codex keeps reviewer policy outside the acting agent and applies managed requirements ahead of user configuration, according to Auto-review’s policy documentation. The default reviewer policy is open source in the Codex repository at codex-rs/core/src/guardian/policy_template.md and policy.md; enterprises replace the tenant section through guardian_policy_config, while users can set local [auto_review].policy.

The key configuration rule is “replace, don’t merge.” Managed requirements take precedence, rather than being weakened by a user’s replacement policy. That distinction matters operationally: make the effective policy inspectable, define precedence explicitly, and ensure the enforcement layer—not the agent—loads it. The related sandbox and approval model is described in agent approvals and security.

The Second Layer: Asynchronous Monitoring That Can Pause a Whole Task

Codex combines sandbox mode, which constrains what an agent can technically do, with approval policy, which determines when it must ask, according to agent security documentation. The default workspace-write keeps network access off. Auto-review evaluates individual actions before execution; monitoring is asynchronous and “can pause a task… A pause can arrive after the activity that triggered it.”

Therefore, “approved” is not a task-level safety verdict: “An action approved by automatic approval review can still be part of a task that monitoring later pauses.” On Codex CLI/mobile and under Zero Data Retention, Modified Abuse Monitoring, or non-US residency, full findings and resume are unavailable—the task simply ends. Destructive app/MCP calls always require approval when the tool advertises a destructive annotation. For dots/Work, orchestrator controls such as approvals and web search live in Global policy, while cloud containers and dots use separate execution configuration; test local and cloud controls separately. See dots safety and the Agents API overview.

Credentials, Read-Only Background Agency, and State That Outlives Disconnection

Credential handling and background research show why permission boundaries need separate data and action policies, as explained in OpenAI’s dots safety documentation. Secure sign-in pauses the model while the user enters credentials directly into the browser environment “without exposing them to the model’s context”; saved-password flows use a dedicated encrypted credential service. The residual risk is explicit: “These protections are specific to secure sign-in and saved-password flows; a secret placed separately in a readable message or document may still be visible to the model.”

Proactive research is read-only by design and enforced in code: tasks use read-only tools to gather from permitted connected sources and save private notes. “We enforce these limits in code: the research tasks cannot directly send messages to other people, change content in connected apps, or control a browser or desktop.” Each dot has its own resettable context. Disconnecting an app stops new information sharing, but “information a dot has already learned remains in its own context”; deleting or resetting the dot is the only way to remove it. See the dots help article.

What the Layer Does Not Guarantee (In OpenAI’s Own Words)

OpenAI explicitly limits the security claim for Codex Auto-review in its public documentation: “Auto-review improves the default operating point for long-running agentic work, but it is not a deterministic security guarantee. It only evaluates actions that ask to cross a boundary. It can still make mistakes… It should complement, not replace, good sandbox design, monitoring, and organization-specific policy.”

What we did not verify: no dots were used, no Auto-review flow was run, and no harness was instrumented. This article therefore makes no claims about observed behavior, detection quality, latency, or operational performance. Treat the documented architecture and its stated limits as the evidence, and validate controls in your own environment before relying on them.

Where the Industry Pattern Is Heading

The industry pattern is moving toward distinct agent identities and safeguards around model context, but the available announcements do not establish comparable performance, as shown by OpenAI’s DevDay recap and Anthropic’s Sonnet 5.5 announcement. Specialist dots in enterprise preview have their own identity and credentials, IT-provisioned hardware, and access to company systems of record; integration with Microsoft Agent 365 is in progress.

Anthropic describes Claude Sonnet 5.5 as the first Sonnet model to launch with safety classifiers that prevent reasoning extraction. Its preserved thinking is account-bound: “Claude’s thinking cannot be decoupled from the account that created it,” and moving conversations between accounts changes behavior. For harness builders, these are related but distinct controls: identity and credential scoping govern agency, while reasoning protections govern what context can be exposed or transferred.

How Do You Automate Approval for Agent Actions?

You automate approval for agent actions by reviewing only consequential boundary crossings and reserving sensitive or ambiguous classes for people, as the Codex approval model illustrates. Keep routine permitted work inside the sandbox; route requests to change access, affect other people, or exceed policy through an independent reviewer. Preserve denial reasons, forbid equivalent workarounds, and make human handoff a valid terminal outcome.

A practical design pairs pre-execution decisions with a separate monitor that can halt broader work, while keeping enforcement and policy out of the acting agent’s writable environment. Use narrow, auditable overrides only where policy permits them. Do not treat reviewer approval as a substitute for least privilege, human-only classes, or task-level monitoring.

FAQ

These answers summarize the documented distinctions between sandbox limits, reviewer decisions, and timeouts in the Codex Auto-review guide and agent security documentation. The key implementation point is to model each as a separate state: permission boundary, review outcome, and unavailable reviewer are not equivalent.

Does auto-review replace sandboxing?

No. Auto-review checks actions that request crossing a boundary, while sandboxing limits what the agent can technically access or change. The Codex documentation says the acting agent remains in the same sandbox and Auto-review does not expand writable roots or network access. OpenAI says the layer should complement, not replace, sandbox design, monitoring, or organization-specific policy.

Can a user override a denied action?

A user can use /approve to select one recent denial and authorize one retry of that exact action. The retry still goes through Auto-review, and the reviewer can deny it again when policy says the user cannot override that class. Approval is not authorization for similar future actions and cannot override core safety requirements.

What happens when the reviewer times out?

A timeout is surfaced separately from a denial; a timeout alone is not proof that the proposed action is unsafe. The documentation distinguishes these states rather than applying denial semantics to an unavailable review. A harness should preserve that distinction and follow its own fail-closed or escalation policy without misrepresenting the timeout as a safety judgment.

Conclusion

The approval gate is becoming an agent, but the useful design lesson is separation: a reviewer distinct from the actor, enforcement beyond the actor’s reach, pre-action checks paired with asynchronous monitoring, and explicit human-only classes. OpenAI documents concrete mechanics for denials, scoped retries, and circuit breaking, while also stating that Auto-review is not a deterministic guarantee. Copy the boundaries and failure semantics; keep sandboxing, monitoring, and human judgment in the system.