Skip to content

Coding-Agent Auto-Approval Modes (Sep 2026): Implementation Depth and a Cross-Harness Survey

Research date: 2026-09-05. Questions: (1) Is Codex CLI auto-approve simply "spawn an agent to review a tool call," or does implementation matter? (2) If it is that simple, are the community DeepSeek Harness plugins safe enough? (3) What are other coding-agent harnesses — including OpenClaw — doing for the same problem, given that true full-auto on an unsandboxed home PC looks unsafe? OpenAI claims are cited to OpenAI Docs / the Alignment Research post; other tools cite their own official docs or open-source repos.

TL;DR

  • The conceptual core is simple — a separate reviewer decides whether a boundary-crossing tool call may run — but production value is almost entirely in the details around that call. Who reviews what, with which context, under which policy, with what deterministic pre-checks, what happens on denial/failure, and whether grants are one-shot all determine whether the feature reduces risk or is a rubber-stamp.
  • Implementation demonstrably matters. Even a well-staffed open-source project shipped an auto-review bug where sed was classified as read-only, letting sed -i mutate files without human review (OpenClaw PR #70543). The reviewer layer itself can be prompt-injected through tool output (dsh-approval-llm warning).
  • The industry has converged on one layered pattern: keep the agent inside a restricted sandbox; let allowlist/safe-command layers decide deterministically; send only approval-miss calls to a separate reviewer model (or human policy); grant one-shot; fail closed; add a circuit breaker; audit.
  • Community DSH plugins implement the same architecture and are reasonable for low-risk local work after code review and pinning — but they are not a safety boundary. They run inside the DSH host process as unvetted third-party code, and DSH has no official security audit.
  • Full-auto on an unsandboxed home PC is not "safe" in an absolute sense; it can only be made less unsafe. That is exactly why the ecosystem's middle option exists: keep a workspace-write-style boundary and let a reviewer replace most human approvals there. True unattended autonomy belongs in containers/VMs/CI.

1. What Codex auto-approve actually is under the hood

OpenAI Docs describes Auto-review as "a reviewer swap, not a permission grant": the main agent keeps working under workspace-write with the same approval policy, and eligible escalation requests are routed to a separate reviewer agent instead of pausing for a person (official Auto-review docs). OpenAI's rationale post adds that the main agent is optimized to complete the task while the reviewer has the narrower job of deciding whether a specific boundary-crossing action should run; the separation makes the approval policy easier to evaluate, monitor, and improve (Alignment Research).

So the decision is made by a reviewer-agent call, but the surrounding machinery is the feature:

  1. Only real boundary-crossing requests reach the reviewer. Actions already allowed by the sandbox (or denied deterministically by it) never trigger review. Eligible categories are shell/exec escalation, blocked network, edits outside writable roots, approval-gated MCP/app calls, and new Computer Use domains (official docs).
  2. The reviewer sees a deliberately constructed context. A compact transcript plus the exact approval request — user messages, surfaced assistant updates, relevant tool calls/outputs, the proposed action — but not the main agent's private chain-of-thought (official docs).
  3. There is a written policy and a structured verdict. The default reviewer policy lives in the open-source Codex repository; enterprises/users can replace or extend it. The reviewer grades risk and returns an outcome with rationale — community write-ups describe a risk/authorization/outcome/rationale shape (community internals write-up), and Codex issue reports say auto-review can approve, deny, or abort (Codex issue #21975, official docs).
  4. Denial is not a normal sandbox error. The rationale goes back to the main agent with an instruction not to pursue the same outcome via workaround or policy circumvention, and to continue only with a materially safer alternative or stop and ask the user (official docs).
  5. A rejection circuit breaker exists. The open-source implementation interrupts the turn after 3 consecutive denials or 10 denials in a rolling window of the last 50 reviews in the same turn; timeouts are surfaced separately from explicit denials (official docs).
  6. Override is deliberately narrow. The TUI /approve flow lets a user select one recently denied action for one retry; the retry still passes through Auto-review, and the marker is developer-scoped and single-use (official docs).
  7. It grants no new authority. Auto-review cannot expand writable roots, enable network access, or weaken protected paths (official docs).

OpenAI is also explicit that this is not a deterministic security guarantee: it only evaluates boundary-crossing actions, can be misled in adversarial contexts, and does not defend against scheming that produces benign-looking escalations (Alignment Research).

2. Why implementation details matter

A naive "ask another model" loop is easy to defeat: if the reviewer shares the main agent's prompt/policy, the agent can tailor asks to pass review; if the reviewer sees only the agent's stated justification, it judges claims rather than the real command/args; if there is no deterministic first layer, every weird command costs an LLM round-trip; if there is no fail-closed behavior, reviewer outage becomes approval; if denials are ordinary errors, the agent loops variants; if grants are remembered, one lapse becomes permanent.

Concrete evidence:

  • OpenClaw's native auto-review PR was flagged because sed sat in the read-only binary list even though sed -i rewrites files; under auto mode a file-mutating command would have been auto-approved without human review (OpenClaw PR #70543).
  • The Letter2025 DSH plugin warns its AI reviewer can be prompt-injected through tool output or the agent's reasoning and is "a policy choice, not a security guarantee" (dsh-approval-llm).
  • OpenAI's red-teaming found cases where Auto-review approved commands without user approval; they describe the class as "not a source of deterministic guarantees" (Alignment Research).
  • Deterministic allowlist edge cases are a whole discipline: shell chaining, command substitution, symlinks, wrappers, interpreters, and argv validation (OpenClaw exec approvals — advanced).

3. The converged design across harnesses

System Middle mode Who decides misses Notable safety mechanisms
Codex --approve-for-me / auto_review Separate reviewer agent Sandbox stays workspace-write; structured verdicts; anti-circumvention denials; circuit breaker; narrow /approve override; managed policy
Claude Code auto mode Second model, the classifier Classifier reviews instead of human; some actions never auto-approved even in bypass; deny rules work in every mode; bypassPermissions documented for containers/VMs
Qwen Code auto mode LLM classifier Deterministic deny rules first; over-broad allow rules stripped in auto; fail-closed; loop guard → manual after 3 blocks
Gemini CLI autoEdit + policy engine Deterministic allow/deny/ask_user rules Tiered policy priorities; admin policies OS-protected; permanent approvals never flow back into plan mode
OpenHands Confirmation policy + security analyzer Risk analyzer Risk levels → AlwaysConfirm/ConfirmRisky/NeverConfirm
OpenClaw tools.exec.mode: auto Native auto-reviewer, then human; maps to Codex Guardian for Codex sessions Allowlist/safe-bins first; maps to on-request + auto_review + workspace-write; forces out unsafe never+full-access combos; chat /approve forwarding
DeepSeek Harness none built in (community presets) Community reviewer plugins Deterministic routing first; separate reviewer; one-shot grants; fail-closed/fall-to-human; circuit breaker

Codex / OpenAI

Native reviewer agent at the sandbox boundary as described above; selected via approvals_reviewer = "auto_review" with approval_policy = "on-request" and sandbox_mode = "workspace-write" (official docs).

Claude Code (Anthropic)

Claude Code's auto mode uses a second model, the classifier, to review actions instead of the human; the docs describe auto as "everything, with background safety checks" and note it is the built-in starting mode on Pro/Max/Team plans where available (Claude Code permission modes). Some actions are never auto-approved even in auto/bypass (explicit ask rules, connector tools set to ask, tools requiring user interaction, critical-path rm/rmdir), and bypassPermissions is documented for isolated containers/VMs only (Claude Code permission modes). Hooks (PreToolUse, PermissionRequest) let users add deterministic gates before prompts; a hook deny applies even under bypassPermissions (Claude Code hooks).

Qwen Code

Five modes: Plan, Ask Permissions, Auto-Edit, Auto (classifier-driven), and YOLO. In Auto mode, an LLM classifier evaluates shell commands, network calls, and out-of-workspace edits; read-only and in-workspace operations skip it. Guardrails: permissions.deny hard rules run first; over-broad allow rules are temporarily disabled in Auto; the classifier fails closed when unreachable (two consecutive unavailable calls → manual fallback); a loop guard sends the next call to manual after three consecutive policy blocks (Qwen Code approval mode).

Gemini CLI

Gemini CLI is policy-engine-first: deterministic TOML rules with allow / deny / ask_user, tiered priorities (default/user/admin), approval modes (default, autoEdit, plan, yolo), and persistent approvals that flow only toward more permissive modes, never back into plan (Gemini CLI policy engine). Admin policy directories are OS-protected. No separate reviewer agent appears in that model; the middle ground is expressed as deterministic rules plus routing.

OpenHands

OpenHands separates a security analyzer (assigns LOW/MEDIUM/HIGH/UNKNOWN risk) from a confirmation policy (AlwaysConfirm / NeverConfirm / ConfirmRisky). Its built-in LLMSecurityAnalyzer has the agent annotate its own tool calls with security_risk inline; a separately configured analyzer can also be used (security architecture, security guide). Inline self-labeling avoids a second model call but asks the actor to grade its own action — a weaker separation than Codex/Claude's separate reviewer.

OpenClaw

OpenClaw is the most relevant "harness above harnesses" data point:

  • Host exec has five normalized modes: deny, allowlist, ask, auto, and full. ask and auto share allowlist settings; auto additionally routes allowlist misses through OpenClaw's native auto-reviewer, deferring to human approval only when the reviewer cannot safely approve (permission modes).
  • For native Codex app-server sessions, auto maps to Guardian-reviewed Codex: approvalPolicy=on-request, approvalsReviewer=auto_review, sandbox=workspace-write, and OpenClaw forces that over configured overrides so unsafe never + danger-full-access combinations are not preserved (permission modes).
  • Native auto-review returns a one-shot allow or routes ask/malformed/unsupported outcomes to a human (PR #70543).
  • Deterministic handling precedes the model: safe bins, argv validation, trusted binary dirs, symlink/wrapper handling, interpreter/runtime binding (exec approvals — advanced).
  • ACPX sessions get separate modes (approve-reads, approve-all, deny-all) plus nonInteractivePermissions: fail|deny (permission modes).
  • Approvals can be forwarded to chat channels with /approve <id> allow-once|allow-always|deny (exec approvals — advanced).

4. Are community DSH plugins "safe"?

The DSH plugins surveyed in the DeepSeek Harness ecosystem report implement most of the layered design — separate reviewer prompt, deterministic routing before the model call, tool arguments recovered from the session log, one-shot allowed-once, fail-closed or fail-to-human, circuit breakers, audits. In that sense they are not naive "ask a model yes/no" hacks.

But "safe enough" still depends on things a plugin cannot fix:

  1. Trusting the plugin code — it runs inside the DSH host process with your keys; DSH has no official security audit (DSH release notes).
  2. Trusting the reviewer model — it can be prompt-injected through tool output or agent reasoning (dsh-approval-llm).
  3. Deterministic misclassification — the sed -i bug class is plausible in any young unvetted codebase (OpenClaw PR #70543).
  4. DSH compatibility — plugin API is pre-GA and breaking; pin versions and re-verify after upgrades (companion report).

Practical guidance:

  • Low-risk local development on a restorable machine: a conservative DSH auto-review plugin (deterministic rules first, separate reviewer, one-shot grants, fail-closed/fall-to-human, circuit breaker) is defensible after source review, pinning, and keeping the sandbox at workspace-write.
  • Anything with real credentials, production access, or irreversible side effects: keep human approval, or use a real sandbox/VM/container and treat review as defense in depth.
  • Before unattended runs: run canary tests — in-workspace positive path, out-of-root write, fake-secret denial, reviewer outage, rollback (rollout guide).

5. Is full-auto on an unsandboxed home PC ever doable?

Not as a guaranteed safety posture. On a normal desktop account there is no OS-level boundary between the agent and your files/credentials/network, so any "full-auto" mode is one bug, one injection, or one misjudgment away from harm. The ecosystem's answer is a middle operating point:

  • The agent runs inside workspace-write-style permissions (or an OS sandbox when available).
  • Deterministic rules decide routine cases.
  • A separate reviewer (model or policy) decides boundary cases a human used to see.
  • The human remains the last-resort fallback; everything is audited.

Codex, Claude Code, Qwen Code, and OpenClaw all reached essentially this design under different names. On an unsandboxed machine the honest ranking is: workspace-write + human ask → deterministic allowlist + human ask → auto-review middle tier → container/VM with full-auto → bare-host full-auto (last choice).

6. Where Codex fits in this comparison (positioning)

Judged narrowly as "native implementation of agent-reviewed approval at the sandbox boundary," Codex looks like the strongest implementation as of 5 Sep 2026: first-party rather than a plugin, the most detailed operational documentation, structured verdict + rationale flow, anti-circumvention denial semantics, circuit breaker, deliberately narrow override, enterprise-managed policy, open-source implementation, and published adversarial-evaluation/red-team notes. Claude Code's built-in classifier mode and Qwen Code's classifier-driven Auto mode are the closest architectural peers; Gemini CLI's deterministic policy engine is stronger where you want admin-enforced rules rather than a model reviewer; OpenClaw is strongest when one surface must govern several harnesses.

But "best feature implementation" is not "best fit for your machine." Codex auto-review is tied to the Codex CLI/app-server environment and to an on-request + workspace-write posture; DSH users can only approximate it with the community plugins surveyed in the companion report, and no implementation makes an unsandboxed desktop a safe full-auto environment. The practical conclusion to carry forward: Codex wins the feature-maturity comparison, while the operative product decision is still which harness, sandbox boundary, and review policy fit the machine and trust model you actually run.

Primary sources