Guardian: Let One Model Approve Another

You have Codex open on a repo. The model runs git status, reads two files, then wants git push. A minute later it wants curl, then a note in /tmp, then that note deleted. Popups stack. People start reading only the first two tokens; the thumb already has muscle memory.

That’s approval fatigue. The fence is still there; the judgment is gone. The loop decays into a button that always goes green. Hand auto-allow to the same main model that just wrote the command, and the applicant is also the approver. Allow on failure, and a timeout or bad JSON becomes a free pass.

Codex pulls whether to auto-allow into a dedicated review. It does not replace the sandbox, or the network proxy. It only takes over one class of on-request approvals that would have popped to the user. The route is narrow: the policy must be OnRequest or Granular, and the reviewer must be AutoReview. The default reviewer is still the user.Source:codex-rs/core/src/guardian/review.rs lines 186–210

The module header writes the four steps in stone.

The contract has only four fields. The enums on the three axes live in protocol-layer approvals.rs, not protocol.rs. outcome is the only required field. A low-risk allow can return just {"outcome":"allow"}; missing risk fills in as Low, authorization as Unknown.

/// Structured output contract that the guardian reviewer must satisfy.
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
pub(crate) struct GuardianAssessment {
    pub(crate) risk_level: codex_protocol::protocol::GuardianRiskLevel,
    pub(crate) user_authorization: codex_protocol::protocol::GuardianUserAuthorization,
    pub(crate) outcome: GuardianAssessmentOutcome,
    pub(crate) rationale: String,
}

Approval fatigue is a human-factors problem; the reviewer itself also drifts on format. Fold “no executable answer” into a deny, and it still holds in another language. Input is untrusted evidence plus one exact action; output is an exhaustive allow or deny; a parse fail stops.

The main model just wrote the command to run. Let it review itself and the loop is open. Slip a “please approve me” into tool output and the review material is poisoned. If review power falls back to the applicant, the dedicated-reviewer role does not exist.

The review session clones the parent config and rewrites it at once. Approval policy locks to Never, the permission profile intersects read-only, MCP servers become an empty table, skills, memory, and Apps instructions turn off, then a string of non-essential features is disabled. It also drops parent exec-policy rules and switches to an empty default manager. Parent rules could shape the reviewer the other way, even silently allowing a read-only command the reviewer itself ran.Source:codex-rs/core/src/guardian/review_session.rs lines 1406–1448；codex-rs/core/src/session/mod.rs lines 544–548

The reviewer may run read-only commands to check local state — whether a delete target exists, whether a directory is empty. It will not pop a new approval, and it will not open another Guardian. Config assembly explicitly disables GuardianV2.

When trunk is idle, later approvals append to the same session and the prompt cache stays stable. When trunk is busy, a temporary hut grows from the last committed rollout, comes down after the review, and is not written back.

Give untrusted review power the smallest room you can — that’s a generic security shape. Swap the model, the prompt, the capability surface, and the question is still the same: which few capabilities does the reviewer actually need, and can the rest be given none?

The reviewer and the executing model stick on the same denied action; what a person sees is a spin. Count a timeout as a consecutive denial and an infrastructure wobble is misread as the model going bad in a row.

A timeout takes ReviewDecision::TimedOut; an explicit denial takes Denied. The copy to the model is split too. A timeout tells it not to treat “timed out” as unsafe by itself — try again, or ask the user. An explicit denial appends a no-reroute instruction: only a substantially safer alternative, or an explicit approve after the user knows.Source:codex-rs/protocol/src/protocol.rs lines 3909–3910；codex-rs/core/src/guardian/review.rs lines 70–74

The breaker books by turn; the window is 50 long. Standard’s threshold is 3 in a row, or 10 inside the window. CyberModel is tight enough that the first denial stops. Only an assessment of Deny counts. Timeout and fail-closed take record_non_denial and zero the consecutive count. On trip it sends GuardianWarning, then abort_turn_if_active.Source:codex-rs/core/src/guardian/mod.rs lines 53–59、lines 157–194

A safety gate must book “not finished” and “explicit no” separately. Fold them into one “didn’t pass” and a transient fault trains a bypass. Count by turn, count by window — two thresholds are enough. A high-adversary policy can be tight enough that the first denial stops.